Busaba targeted by Devman ransomware group with a ransom demand

• Ransomware group: Devman
• Country: United Kingdom
• Sector: Hospitality
• Announcement date: September 29, 2025

Devman claims to have compromised Busaba data

The threat actor known as Devman has published a ransom announcement on its leak site, claiming the compromise of data belonging to Busaba. This announcement, which appeared on September 29, 2025, marks a significant development in the ongoing threat landscape facing the hospitality sector. The claim suggests that the organization has been targeted in a ransomware attack, though the group's specific methods and the full extent of the incident remain under scrutiny.

Ransomware attacks often involve a tactic known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public or private leak sites, threat actors increase the pressure on the victim to meet financial demands. In this instance, the Devman group has officially listed Busaba on its leak site to publicize their claim.

Details of the ransom demand

According to the announcement issued by the Devman group, a ransom demand of 580,000 USD is being requested from the organization. This demand is part of the group's attempt to extort the company following the alleged breach. While the group has made this public claim, it is important to note that information regarding this specific group remains limited in the public domain, making it difficult to ascertain their full operational history or typical patterns.

The announcement was made on the same day as the claimed attack date, September 29, 2025. At this stage, the specific details regarding the nature of the allegedly compromised data have not been provided by the threat actor. The listing does not specify the volume of files or the total size of the data involved in the purported breach.

About Busaba

Busaba is a London-based restaurant chain specializing in Thai cuisine. The company offers modern Thai dishes and operates various locations across the United Kingdom. As a prominent player in the hospitality sector, the organization maintains a significant presence in the UK market.

Potential impact and organizational implications

This claim may negatively impact the organization's operational continuity and reputation. If a data breach has indeed occurred, legal obligations under the UK GDPR, which is the data protection legislation of the United Kingdom, may arise. Organizations facing such claims must navigate complex regulatory environments to ensure compliance with privacy laws.

Secondary risks associated with such incidents include the potential use of compromised data for identity theft or targeted phishing attacks against customers or employees. It is a critical consideration in cybersecurity that even if a ransom is paid, the security of the data cannot be guaranteed, as the integrity of the information may have been compromised long before the extortion attempt.

To address such claims, organizations typically need to initiate forensic investigations to verify the breach claims and notify the relevant regulatory authorities. Common defensive steps for organizations in the hospitality sector include implementing robust access controls, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized movements. Such measures are essential to mitigate the risks posed by evolving ransomware threats and to protect both corporate assets and consumer privacy.

• No specific data types were identified in the listing.