Inter care Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 8, 2025, the ransomware group devman listed Inter care on its leak site, stating that it had obtained internal files from the organisation. The number of people affected remains unknown, and no independent confirmation of the data volume or contents has been made public. The listing indicates that the material includes a full QuickBooks dump along with patient and financial records, though the precise scope of any exfiltration is still unverified. The incident matters because healthcare and care providers routinely process sensitive personal and financial information. When such data appears on a ransomware leak site, individuals connected to the organisation face the possibility that details they entrusted to the service could circulate beyond their control.

Inside the incident

Public reporting on the event is limited to the December 8 listing itself. The group claims it carried out a ransomware attack that resulted in the exfiltration of internal files. No official statement from Inter care has been referenced in available records, and details such as the date of the intrusion, the method of access, or the quantity of data involved have not been disclosed.

Who is devman?

Devman is a ransomware operation that follows the common pattern of encrypting victim systems and threatening to publish stolen data unless a ransom is paid. Like similar groups, it maintains a leak site where it lists organisations it claims to have targeted. Its activity is documented through multiple prior listings across different sectors, though each claim requires separate verification.

About Inter care

Inter care operates in the care sector, where organisations manage patient records, treatment histories, and associated administrative and financial information. Such entities hold data that includes personal identifiers, medical details, and billing records. A breach affecting this type of organisation is consequential because the information is both sensitive and difficult to change once exposed.

The information in question

The listing describes internal files that include a full QuickBooks dump, patient data, and financial data. No further breakdown of file types, record counts, or specific fields has been released. Organisations of this kind typically store names, contact details, medical information, insurance data, and payment records; however, the exact contents tied to this incident remain unconfirmed beyond the group’s description.

The real-world impact

Exposed patient and financial data can be used for identity theft, insurance fraud, or targeted scams. Individuals may face prolonged monitoring of accounts and credit files. For the organisation, the incident adds operational disruption from any ransomware component and potential regulatory scrutiny over the handling of personal health information.

If your data was in this claimed breach

Begin by monitoring bank and insurance statements for unusual activity and consider placing fraud alerts with credit agencies. Change passwords for any accounts linked to the organisation and enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data to check for appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.