**.at Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 25, 2026, the organization **.at appeared on a leak site maintained by the devman ransomware group. The group claims to have obtained internal files through a ransomware operation. No information has been released on the number of people affected or the volume of data involved. This development follows a pattern in which ransomware actors publish victim names to encourage payment or public attention. Public records currently contain no independent confirmation of the claims or additional technical details.

What happened

The only confirmed public record is the listing of **.at on the devman leak site on January 25, 2026. The entry states that internal files were exfiltrated. No further details on the timing of the intrusion, the method of access, the encryption status of systems, or any ransom demand have been disclosed.

The group behind it: devman

Devman is a ransomware operation that follows the double-extortion model common among current threat actors. The group typically encrypts victim systems and removes copies of data, then posts victim names on a dedicated leak site when negotiations stall. Public reporting on the group shows repeated use of this approach against organizations in multiple sectors, with listings used to increase pressure for payment.

The listing of **.at constitutes the group’s claim that data was taken. No independent verification of the claim or of any subsequent data release has been reported.

Who is **.at?

**.at is an organization operating under an Austrian domain. Entities registered with .at addresses are subject to Austrian and European data-protection rules and commonly hold records related to customers, employees, partners, or internal operations within Austria or the European Union.

Organizations of this type routinely process personal and business information required for service delivery, regulatory compliance, and internal administration. A claimed intrusion therefore raises questions about the handling of data that falls under EU privacy frameworks.

The information in question

The listing refers only to “internal files.” No inventory of specific data categories, file counts, or formats has been published. Organizations of this kind typically maintain employee records, customer or client details, financial documents, and operational correspondence. The exact contents of any exfiltrated material remain unconfirmed.

Why it matters

Exposure of internal files can reveal operational procedures, contact information, or other material that may be used for further targeting or fraud. For individuals whose data resides in such files, the primary risks include misuse of personal identifiers or account details. For the organization, the incident adds to the costs of investigation, potential regulatory review under Austrian and EU rules, and restoration of systems.

Because the scale and content of the data remain undisclosed, the full extent of consequences cannot yet be assessed from public information.

Were you affected?

Individuals can begin by monitoring official statements from **.at and any notifications required under data-protection law. Checking email addresses against known breach datasets provides one practical step; several free online services allow users to run such a scan. Organizations that hold personal data are expected to notify affected parties when required by regulation, and further updates may appear from Austrian authorities or the company itself.

AICompiled with AI assistance from public sources and published under our editorial standards.