f*t*r*.com.** Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
f*t*r*.com.** was listed by the devman Ransomware Group on November 17, 2025, after internal files were exfiltrated in a ransomware attack. Check whether your information was exposed and consider any recommended protective steps.
People connected to f*t*r*.com.** face the possibility that internal files from the organisation have been taken and may be released. On 17 November 2025 the devman ransomware group listed the organisation on its leak site and stated that 120 GB of data had been removed during a ransomware operation for which a payment of 300k was demanded. The number of individuals whose information is involved remains unknown.
What happened
The incident was first noted publicly on 17 November 2025 when the devman group added f*t*r*.com.** to its leak site. The group claims to have exfiltrated 120 GB of internal files during a ransomware attack and lists a ransom demand of 300k. No further details on the timing of the intrusion, the method of access, or confirmation of data release have been made public. The number of people affected is not stated in the available information.
Who is devman?
Devman is a ransomware group that maintains a public leak site where it lists organisations it claims to have targeted. Such groups typically encrypt systems, remove copies of data, and threaten to publish the material unless a ransom is paid. Their listings serve as a form of pressure on victims. The appearance of f*t*r*.com.** on the site constitutes the group’s claim of involvement; independent confirmation of the claimed data volume or ransom demand has not been reported.
About f*t*r*.com.**
f*t*r*.com.** is an organisation whose internal operations generated the files referenced in the listing. Organisations of this type routinely store records related to their activities, including communications, operational documents and technical materials. A breach involving internal files can affect both the organisation’s own continuity and any individuals or partners referenced in those records, even when the precise contents have not been described.
The information in question
The only description provided is that internal files were allegedly exfiltrated. The exact categories of data within the 120 GB are not disclosed. Organisations in this sector commonly hold employee records, business correspondence, system configurations and partner documentation. Without a confirmed inventory it is not possible to state which of these categories, if any, are present.
The real-world impact
Exposure of internal files can lead to operational disruption for the organisation and to secondary risks for individuals whose details appear in those files. Where personal information is involved, affected people may encounter increased chances of targeted scams or misuse of credentials. The organisation itself may face costs related to investigation, system restoration and any regulatory obligations that follow. Because the scale of personal data remains unknown, the extent of these effects cannot yet be measured.
Were you affected?
Begin by monitoring official statements from f*t*r*.com.** for any guidance it issues to customers or staff. Review your own accounts for unusual activity, especially those linked to the organisation. A free exposure scan of your email address against known breach data sets can indicate whether your information has appeared in previously published collections, though it will not confirm presence in this specific incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
***-***tems.*** Listed by devman Ransomware Grouparko.no Listed by devman Ransomware Groupn*w*****.com Listed by devman Ransomware Groupm*tt**ca**r**.**.it Listed by devman Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the f*t*r*.com.** Listed by devman Ransomware Group →
Publicly posted by devman — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.