Novati Constructions

Summary

Novati Constructions, a Sydney-based construction firm established in 1971, was listed on the Lynx ransomware gang's dark web leak site on 13 January 2025. The attackers claimed to have stolen business and personal data including contracts, financial records, and incident reports from the company, which specialises in construction, refurbishment, and heritage restoration in the Sydney basin.

What Happened

The Lynx ransomware group gained unauthorised access to Novati Constructions' systems and exfiltrated company data. On 13 January 2025, Lynx listed the company on their dark web leak site, claiming the stolen data included contracts, financial information, and incident records. The group employs double extortion tactics, first encrypting victim data and then threatening to publish it if ransom demands are not met.

Novati Constructions, based in Crows Nest, NSW, focuses on commercial, industrial, educational, and aged-care sector projects, coordinating building services as the primary contractor for new construction, refurbishment, and heritage restoration work.

Impact on Individuals

The breach exposed business and potentially personal data including:

• Construction contracts and project documents
• Financial records and data
• Incident reports

Any employees, contractors, or clients whose personal information was included in the stolen business records face potential privacy violations.

Organisational Response

Novati Constructions has not publicly commented on the incident or responded to media requests regarding the breach. The company has not disclosed whether they engaged with the ransomware operators or law enforcement. +++