ctfc.cat Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details sit inside the systems of ctfc.cat now face the practical possibility that those records have left the organisation’s control. When a ransomware group claims to have taken internal files, the immediate stakes for individuals are identity misuse, unwanted contact, or exposure of sensitive work-related information. Public detail remains limited, yet the listing itself is enough to warrant careful attention from anyone connected to the centre.

On 12 November 2025 the ransomware group known as devman listed ctfc.cat on its leak site, asserting that it had exfiltrated 30 GB of internal files and demanding a ransom of 248000. The number of people affected is unknown, and independent confirmation of the claim has not been published. What follows is a factual account of what has been reported and what it may mean for those involved.

What happened

According to the group’s own listing, ctfc.cat was the target of a ransomware attack in which internal files were copied before encryption or other disruption. The listing, dated 12 November 2025, states that 30 GB of material was removed and that a ransom of 248000 was sought. No further technical details—such as the initial access method, the precise date of intrusion, or whether systems were restored—have been released by the organisation or by independent investigators. The volume of people whose data may appear in the taken files is listed as unknown. At present the only public source for these figures is the threat actor’s claim.

Inside devman

Devman is a ransomware operation that follows the now-common double-extortion model: data is stolen, systems are encrypted, and victims are threatened with public release of the material unless payment is made. Groups of this type typically maintain dedicated leak sites where they post victim names, sample files, and countdown timers. Public reporting on earlier campaigns shows that devman has targeted a range of organisations across Europe and elsewhere, often focusing on entities that hold research, administrative or operational records. The group’s listing of ctfc.cat should be read as an unverified claim; no independent forensic confirmation has been made public. Devman has not released additional statements specific to this incident beyond the initial post that names the organisation, the 30 GB figure and the ransom amount.

Who is ctfc.cat?

ctfc.cat is the online presence of the Forest Science and Technology Centre of Catalonia (Centre de Ciència i Tecnologia Forestal de Catalunya), a public research body based in Solsona that studies forest ecosystems, wildfire risk, biodiversity and sustainable land management. Organisations of this kind routinely hold personnel records, research data, partner contracts, grant documentation and correspondence with public authorities and private landowners. A breach at such an institution matters because the data often include both personal identifiers of staff and collaborators and technical information that could affect ongoing scientific work or public-safety planning. The centre’s role in regional environmental policy means that any compromise can have consequences beyond the organisation itself.

The information in question

The only data types named in the public listing are “internal files” said to total 30 GB. No inventory of file names, categories or individual records has been published. Research centres typically store employee and contractor personal data, project proposals, experimental results, financial records and correspondence. Whether any of those categories appear in the material claimed by devman remains unconfirmed. Until a fuller disclosure or independent analysis appears, the exact contents of the 30 GB must be treated as unknown.

The real-world impact

For individuals whose details may be inside the taken files, the concrete risks include phishing that uses accurate personal or professional context, attempts at identity fraud, and unwanted exposure of private correspondence or research affiliations. Staff and partners may also face reputational or competitive harm if unpublished work or contractual terms become public. For the organisation itself, the incident can disrupt ongoing projects, require costly system rebuilds, and erode trust among funders and collaborators. Because the number of affected people is unknown and the precise data types remain unconfirmed, the scale of these effects cannot yet be measured; the risks are real but currently unquantified.

What to do if you're exposed

Anyone who has worked with, contracted for, or supplied personal information to ctfc.cat should treat the listing as a prompt for basic precautions. Change passwords on any accounts that may have been reused or shared with the centre, enable multi-factor authentication wherever it is offered, and monitor bank and credit statements for unexpected activity. Be alert to emails or calls that reference specific projects or colleagues—common signs of targeted phishing. If you receive a notification from the organisation itself, follow its official guidance. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an early indication of wider circulation but does not replace vigilance. Keep records of any suspicious contact and report confirmed fraud to the relevant authorities.

AICompiled with AI assistance from public sources and published under our editorial standards.