Devlion listed on fog leak site following alleged data breach

• Ransomware group: fog
• Country: Israel
• Sector: Technology
• Announcement date: February 4, 2025

Fog group claims Devlion data breach

The technology company Devlion has been listed on a leak site by the threat actor known as fog. According to an announcement published on February 4, 2025, the group claims to have successfully targeted the organization and obtained sensitive information. This development follows a common pattern in modern cyberattacks where threat actors use public leak sites to pressure victims by threatening to release stolen data.

The fog group released their announcement on February 4, 2025, alleging that they have accessed data belonging to Devlion. This type of public listing is a hallmark of double extortion tactics, where attackers not only encrypt a victim's systems but also steal data to use as leverage during ransom negotiations. In such scenarios, the threat actor threatens to publish the stolen information on their dedicated leak site if their demands are not met.

The alleged incident and stolen data

The details provided by the fog group suggest a targeted operation aimed at the organization's development infrastructure. The group's announcement claims that they have successfully accessed the organization's Gitlab source codes. This indicates that the attackers may have focused on the software development lifecycle and the repositories used by the company's engineers.

Regarding the volume of information involved, the group states that the leaked data amounts to 5 GB in size. While the specific file count was not provided in the announcement, the focus remains on the integrity of the development environment. The specific types of data identified in the claim include:

• Source code

About Devlion

Devlion is an Israel-based software development and technology services company. The organization specializes in custom software solutions, web development, and technological consulting services. Given its focus on software development and technological consulting, the company operates within the highly technical technology sector.

Risk assessment and implications

The alleged leak of source code poses significant risks to the organization's intellectual property and trade secrets. When source code is exposed, it can reveal the internal logic of software applications, potentially allowing third parties to identify and exploit vulnerabilities within the code. This exposure could lead to further exploitation by various actors seeking to compromise the software's integrity.

Furthermore, this situation may increase the risk of secondary attacks targeting the organization's technological infrastructure. Once an attacker understands the underlying architecture through leaked code, they may find easier pathways to penetrate other parts of the network. Additionally, because Devlion is an Israel-based entity, legal processes under local data protection regulations may be triggered as a result of this incident.

In the broader context of cybersecurity, organizations in the technology sector often implement various defensive measures to mitigate these risks. Common practices include implementing multi-factor authentication (MFA) across all development environments, enforcing strict access controls for Gitlab repositories, and conducting regular code audits to identify vulnerabilities before they can be exploited. Monitoring for unauthorized access to sensitive repositories and maintaining robust, offline backups are also essential components of a modern security posture. Information regarding the specific capabilities and methods of the fog group remains limited in the public domain.