Abdulhadi Hospital listed on devman ransomware leak site

• Ransomware group: devman
• Country: Jordan
• Sector: Healthcare
• Announcement date: December 1, 2025

The devman ransomware group has listed Abdulhadi Hospital on its leak site, claiming to have compromised the institution's data. This announcement, made on December 1, 2025, identifies the target as a healthcare provider based in Jordan. The threat actor has linked the alleged breach to the domain ecaretest.com and is reportedly demanding a significant ransom to prevent further exposure of the stolen information.

The details of the claim

According to the announcement published by the devman group, the attack is claimed to have occurred on December 1, 2025. The threat actors state that they have successfully exfiltrated a substantial amount of data, which they claim totals 246 GB in size. This type of incident is characteristic of modern ransomware tactics, often referred to as double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage during ransom negotiations.

The group has explicitly demanded a ransom payment of 350,000 USD from the institution to resolve the situation. While the group has made these claims publicly on their leak site, the information remains an unverified claim by the threat actor. Ransomware leak sites serve as a platform for these groups to pressure victims by threatening to release sensitive information if the financial demands are not met.

Data involved in the incident

Regarding the specific content of the leaked information, the group has not provided detailed information regarding the content of the leaked data. However, the data has been identified as belonging to the healthcare sector. The listing names no specific data types or individual files.

Potential risks and implications

This incident may pose risks to the institution's patient privacy and operational continuity. Given the sensitivity of healthcare data, the potential realization of this breach could lead to patients being exposed to identity theft or targeted phishing attacks. Furthermore, the leaked data may be utilized by other cybercriminals, creating secondary risks for the affected individuals and the organization.

From a legal and reputational standpoint, the institution may face legal obligations under data protection regulations in Jordan. Additionally, the organization faces the risk of reputational damage resulting from the public nature of the leak site announcement. Information regarding the specific capabilities and history of the devman group remains limited in the public domain.

About Abdulhadi Hospital

Abdulhadi Hospital is a private healthcare institution operating in Amman, Jordan. The hospital provides diagnostic, treatment, and surgical services across various medical specialties.

Mitigation and defensive considerations

While the specific details of the breach remain under the claim of the devman group, incidents involving healthcare providers highlight the critical need for robust cybersecurity frameworks. Organizations in the healthcare sector often manage highly sensitive personal information, making them high-value targets for cybercriminals. Protecting this data requires a multi-layered defense strategy.

Common defensive steps for organizations include implementing strict access controls to ensure that only authorized personnel can reach sensitive medical records. Regular monitoring of network traffic can help detect unauthorized data exfiltration attempts. Furthermore, maintaining offline, immutable backups is a standard practice to ensure operational continuity in the event of a ransomware encryption event. As seen in this case, the threat of data leakage necessitates not only technical defenses but also comprehensive incident response plans and a clear understanding of regional data protection laws to manage legal and reputational consequences.