GMA NETWORK Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target media organisations as part of a broader pattern of extortion that mixes data theft with public pressure. Listings on leak sites have become a common tactic, used to force negotiations even when the full scope of an intrusion remains unconfirmed by the victim.

On May 06, 2025, the ransomware group known as devman listed GMA NETWORK on its leak site. The group claims it conducted a ransomware attack that involved the exfiltration of internal files and has associated a figure of 2.5 million USD with the incident. The number of people affected remains unknown, and independent confirmation of the claims has not been publicly established.

Inside the incident

Public reporting on this incident is limited to the leak-site listing itself. According to that listing, GMA NETWORK was targeted in a ransomware attack in which internal files were exfiltrated. The reported summary attached to the claim is 2.5 million USD. No further technical details—such as the initial access method, the exact date of intrusion, the volume of data taken, or whether encryption was also deployed—have been disclosed in the available facts. The number of individuals whose information may have been involved is listed as unknown. As with most ransomware claims, the listing should be treated as an assertion by the threat actor rather than verified fact until corroborated by the organisation or independent investigators.

Who is devman?

Devman is a ransomware group that operates in the double-extortion model common among contemporary cybercrime crews. In this model, operators first steal data and then threaten to publish it unless a ransom is paid; encryption of systems is often used as an additional lever. Groups of this type typically advertise victims on dedicated leak sites, post sample files to demonstrate access, and set public deadlines. Their activity is well documented across multiple sectors, including media, manufacturing and professional services. For this specific listing, the only claim attributable to the group is that it exfiltrated internal files from GMA NETWORK and that a 2.5 million USD figure is associated with the incident. No additional statements by the group about this victim appear in the provided facts.

Who is GMA NETWORK?

GMA NETWORK is a major media organisation based in the Philippines, operating free-to-air television, radio and digital platforms. Companies of this type routinely hold large volumes of internal operational data, employee records, contractual documents, production materials and, in some cases, audience or subscriber information. A breach affecting a broadcaster can therefore carry consequences beyond the organisation itself: it may expose staff, freelancers, partners and, potentially, members of the public who interact with the network’s services. Because media companies also serve as trusted sources of information, any successful intrusion raises questions about operational continuity and the integrity of internal systems, even when the precise data taken remains unconfirmed.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases or personal data categories has been disclosed. Organisations in the media sector typically maintain human-resources records, financial and contractual documents, editorial and production materials, and various internal communications. Whether any of those categories were among the files claimed by the group is unconfirmed. The number of people affected is likewise unknown. Until more precise inventories are released by the organisation or by independent analysis, the exact contents of the alleged exfiltration remain unverified.

The real-world impact

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal or professional details, targeted phishing that references internal knowledge, and longer-term identity or credential abuse if contact or authentication data were present. For the organisation, the consequences can include operational disruption, reputational pressure, regulatory scrutiny and the cost of investigation and remediation. Because the scale of the claimed theft and the identities of any affected parties are undisclosed, the full extent of these risks cannot yet be quantified. The 2.5 million USD figure reported in connection with the listing represents the group’s claimed valuation of the incident; it does not state that any payment was made or demanded in a specific form.

If your data was in this claimed breach

If you have a past or present relationship with GMA NETWORK—as an employee, contractor, partner or audience member—consider the following practical steps:

• Monitor financial and email accounts for unexpected activity or password-reset attempts.
• Enable multi-factor authentication on important accounts and change passwords that may have been reused.
• Treat unsolicited messages that reference internal company details with caution and verify them through official channels.
• Request a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

Public detail on this incident remains limited. Continue to rely on official statements from the organisation for any confirmed guidance, and avoid acting on unverified claims circulating online.

AICompiled with AI assistance from public sources and published under our editorial standards.