Arko.no listed on devman leak site claiming client database theft

• Ransomware group: devman
• Country: Norway
• Announcement date: December 7, 2025

Devman claims to have stolen data from arko.no

The threat actor known as devman has officially listed the Norwegian organization associated with the domain arko.no on its dedicated leak site. According to the announcement, the group claims to have successfully exfiltrated sensitive information from the company's internal systems. This claim was published on the group's platform on December 7, 2025, with the group alleging that the actual attack took place on December 6, 2025.

Ransomware groups often utilize leak sites as a method of double extortion. In these scenarios, attackers do not merely encrypt a victim's data to disrupt operations; they also threaten to release stolen information publicly to pressure the organization into paying a ransom. By listing a target on a public leak site, the threat actor aims to maximize visibility and create reputational damage, using the threat of data exposure as leverage during negotiations.

While the listing is a serious claim, it is important to note that the breach has not been independently confirmed. The information provided is based solely on the assertions made by the devman group on their leak site.

Details of the alleged data compromise

The announcement made by the devman group specifically identifies the type of information they claim to have acquired during their intrusion. According to the post, the stolen information is related to the organization's clients.

Affected data types

• Client database

No information was provided regarding the specific size of the data stolen, the total number of files involved, or the specific amount of the ransom demand. The announcement focuses on the fact that a client database (Client DB) has been compromised.

About arko.no

Arko AS is a construction and engineering company based in Norway. The company specializes in infrastructure projects, concrete works, and general contracting services.

Implications and security considerations

This claim suggests that the confidentiality of client data within arko.no may have been compromised. Because the organization is based in Norway, a confirmed breach could lead to legal sanctions and notification obligations under the General Data Protection Regulation (GDPR). Such regulatory frameworks are designed to ensure that organizations protect personal information and notify authorities and affected individuals when a breach occurs.

For the customers whose data may be involved, there are significant risks to consider. If client databases are leaked, individuals may face increased risks related to identity theft and the possibility of being targeted by highly specific phishing attacks. In these cases, attackers use the stolen information to craft convincing messages to trick individuals into revealing even more sensitive credentials or financial information.

Publicly available information regarding the devman group remains limited, making it difficult to attribute the attack or understand the group's full capabilities. In situations where an organization faces such a threat, it is generally advisable for the entity to review its data security processes thoroughly. Organizations in the construction and engineering sectors, which often handle various sensitive project and client details, should prioritize robust defensive measures. This includes implementing strong access controls, monitoring for unauthorized data exfiltration, and ensuring that all affected parties are notified in accordance with legal requirements if a breach is verified.