Devman ransomware group lists chicagobotanic on its leak site

• Ransomware group: Devman
• Country: United States
• Sector: Education
• Announcement date: September 29, 2025

Devman claims a data breach at Chicago Botanic Garden

The Chicago Botanic Garden has been listed on a leak site operated by the ransomware group known as Devman. According to the announcement made by the threat actors, the organization has fallen victim to a cyberattack. The group has publicly claimed that a data breach involving the organization's network has occurred, and they have issued a ransom demand of 590,000 USD in connection with this incident.

Ransomware attacks often involve a tactic known as double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The attackers then threaten to release this stolen information on public leak sites if the ransom is not paid. This creates a dual pressure on the victim: the need to restore operational functions and the need to prevent the public exposure of confidential information.

Details of the claim

The announcement regarding the Chicago Botanic Garden was posted on September 29, 2025. The Devman group's post specifically claims that they have gained access to the organization's network and that a breach has taken place. While the group has made these claims, the specific details regarding the nature of the alleged breach remain limited to the information provided on their platform.

Information regarding the leaked data

Despite the claims made by the Devman group, there is no specific information regarding the nature of the allegedly leaked data in the provided registration details or screenshots. The listing does not specify what types of files or information were targeted during the incident.

• No specific data types were named in the listing.

When organizations face such threats, the lack of clarity regarding what was stolen can make it difficult to assess the immediate impact. This uncertainty often leads to extended investigations to determine whether the stolen data includes personally identifiable information, intellectual property, or financial records.

About the Chicago Botanic Garden

The Chicago Botanic Garden is a large botanical garden and research center located in Glencoe, Illinois. The institution focuses on plant science, conservation, and education. Spanning 385 acres, the institution conducts scientific research aimed at preserving plant diversity alongside its public garden displays.

Potential impact and organizational risks

This incident may result in the exposure of the organization's sensitive data. As a US-based entity, a potential data breach could trigger legal processes under state-level privacy laws and federal regulations. The legal landscape for data protection in the United States is complex, involving various state and federal mandates that organizations must navigate following a security incident.

Beyond the immediate legal implications, secondary risks may include the use of leaked data for identity theft or targeted phishing attacks. If sensitive information is indeed exposed, malicious actors may use it to craft highly convincing social engineering campaigns against employees or stakeholders. Furthermore, the organization's operational continuity could be negatively impacted, and the institution may face significant reputational damage as a result of the public listing.

For organizations operating in the education and research sectors, maintaining robust cybersecurity postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular network monitoring to detect unauthorized access. Because public information regarding the Devman group is limited, organizations must remain vigilant against the evolving tactics used by such threat actors.