CANCER claims data breach by devman group

• Ransomware group: devman
• Country: Brazil
• Sector: Financial Services
• Announcement date: December 14, 2025

Devman group claims to have breached CANCER

The devman group has posted an announcement on a leak site claiming responsibility for a data breach targeting CANCER. According to the post, the group claims to have obtained sensitive information belonging to the institution. This announcement follows a pattern often seen in modern cyberattacks, where threat actors use leak sites to pressure organizations by threatening to release stolen data to the public.

The group made its announcement on December 14, 2025. According to the claims made by the threat actor, the unauthorized access and subsequent compromise of data allegedly occurred during an incident on December 11, 2025. While the group has claimed responsibility for the breach, no screenshots or specific evidence were provided in the initial announcement to verify the contents of the stolen data.

Claimed data and impact

The devman group has stated that the information they have obtained is highly sensitive. They have threatened to release files that are said to contain critical information regarding the institution's operations and its stakeholders. Specifically, the group claims the stolen data includes:

• Financial data
• Client data

The lack of specific details regarding the total volume of data or the exact number of files involved means the full scope of the breach remains unquantified at this time. In many ransomware scenarios, groups utilize a tactic known as double extortion, where they not only encrypt an organization's systems but also steal data to use as leverage during ransom negotiations. By threatening to publish this information, attackers aim to maximize the pressure on the victim organization.

About CANCER

The Instituto Nacional de Câncer (INCA) is a national reference institution under the Brazilian Ministry of Health, specializing in cancer prevention and control. It operates in the fields of cancer research, education, and patient care.

Risk assessment and industry implications

This incident may pose significant risks of identity theft and fraud for the institution's clients. The exposure of financial data could lead to reputational damage and potential legal consequences for the institution under Brazil's LGPD (General Data Protection Law). Furthermore, the leak may create secondary risks for the institution's supply chain partners, as interconnected data environments often mean a breach in one entity can impact others in the network.

Information about the devman group is limited, making it difficult to attribute the attack to a specific known entity or to understand their long-term motivations. For organizations operating within the financial services sector, such incidents highlight the critical importance of robust security measures and proactive data protection strategies.

To mitigate such risks, organizations typically focus on several defensive pillars. Implementing strong access controls and multi-factor authentication can help prevent unauthorized entry. Regular security audits and vulnerability assessments are essential for identifying weaknesses before they can be exploited by threat actors. Additionally, maintaining offline, encrypted backups is a fundamental step in recovering from ransomware attacks. Following a breach, organizations are often required to follow strict regulatory frameworks, such as the LGPD, which may necessitate notifying affected parties and regulatory bodies to maintain transparency and compliance.