d*v***.cl Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 18, 2025, the ransomware group devman listed d*v***.cl on its leak site. The entry states that internal files were exfiltrated during a ransomware attack on the organisation. No confirmed count of affected individuals has been released.

The incident forms part of the continuing pattern of ransomware operations that target organisations holding sensitive personal data. Such listings do not always indicate that data has been published, but they signal that the group asserts possession of material taken from the victim.

What happened

The only confirmed detail is the December 18, 2025 listing by devman. The group claims internal files were removed from d*v***.cl systems. The date of the underlying intrusion, the method of initial access, and the volume of data involved have not been disclosed publicly.

The group behind it: devman

Devman is a ransomware operator that maintains a leak site to publish data it states was taken from victims. The group’s listings function as a claim of responsibility and possession; independent confirmation of the claims is not provided by the listing itself. Public reporting on the actor has documented repeated use of data-exfiltration tactics alongside encryption in prior incidents.

d*v***.cl and its sector

d*v***.cl operates in a sector that routinely processes patient health information. Organisations of this type maintain records that include clinical notes, laboratory results, and identification documents. A breach affecting such an entity therefore touches data that individuals typically expect to remain confidential under medical-privacy norms.

What was likely exposed

The listing refers to internal files taken in a ransomware attack. The accompanying summary mentions patient records, HIV test results, and identification documents. Exact data categories, file counts, and confirmation of contents remain unverified beyond the group’s claim.

Why it matters

Health-related records can contain information that affects employment, insurance, and personal relationships if disclosed. When identification documents are also involved, the combination raises the possibility of identity misuse. For the organisation, the incident adds operational, regulatory, and reputational consequences that extend beyond immediate recovery costs.

Were you affected?

Individuals who have received services from d*v***.cl should monitor statements from the organisation and any official notifications. A practical first step is to review account activity at any linked health or government portals. Readers may also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.