www.mims.com Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 21, 2026, the ransomware group devman listed www.mims.com on its leak site and stated that internal files had been taken during a ransomware operation. No figure for the number of people affected has been released, and the organization has not confirmed the scope or timing of any intrusion. The incident occurs against a backdrop in which ransomware operators routinely publish claims of access to corporate networks in order to pressure victims into payment.

Inside the incident

Public information about the event is confined to the listing itself. The group asserts that files were removed from the site’s systems, yet no independent verification of the claim has appeared. The number of records involved, the date range of the activity, and the precise method of initial access remain undisclosed. No ransom demand amount or negotiation status has been reported.

Who is devman?

Devman is a ransomware group that maintains a public leak site where it lists organizations it claims to have compromised. The group follows the common pattern of double-extortion operations: it states that data were copied before encryption and then publishes file samples or directory listings to encourage payment. Its listings have covered entities in multiple sectors, though each claim on the site originates from the group and is not automatically corroborated by third parties.

www.mims.com and its sector

www.mims.com operates as an online reference platform for medical professionals, primarily serving users in the Asia-Pacific and Middle East regions. It supplies drug monographs, prescribing information, medical news, and continuing education materials to doctors, pharmacists, nurses, and students. Platforms of this type routinely store user account details, professional credentials, and internal editorial or operational documents in addition to the clinical content they publish.

The information in question

The listing states only that internal files were exfiltrated. No inventory of specific data categories has been published by either the group or the organization. Organizations that maintain medical reference databases commonly hold staff email addresses, login credentials, subscriber information, and documents related to content production; however, whether any of these categories were among the files taken in this case has not been confirmed.

Why it matters

Even without a confirmed count of records, the presence of internal files from a medical-information service raises the possibility that professional contact data or operational documents could be used for targeted phishing or further network access attempts. For the organization, the incident adds to the operational burden of investigating the claim, notifying regulators if required, and restoring trust with its professional user base.

What to do if you're exposed

Individuals who hold accounts with medical-reference platforms can take several immediate steps to limit potential follow-on risks.

• Change passwords for the affected service and any other accounts that reuse the same credential.
• Enable multi-factor authentication on email and professional accounts.
• Monitor incoming messages for unusual requests that reference the service or medical licensing details.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.