Devman ransomware group lists diethelmtravel on its leak site

• Ransomware group: Devman
• Country: Thailand
• Sector: Hospitality
• Announcement date: August 4, 2025

Devman claims responsibility for Diethelm Travel breach

The threat actor group known as Devman has announced on its leak site that it has targeted Diethelm Travel. According to the announcement made on August 4, 2025, the group claims to have compromised data belonging to the organization and is currently demanding a ransom for its return.

This incident follows a pattern often seen in modern cyberattacks where threat actors utilize dedicated leak sites to pressure victims. These platforms serve as a public stage for extortion, where groups post details of their targets to increase psychological and reputational pressure on the affected organization.

Details of the alleged extortion attempt

The Devman group has stated that it is demanding a ransom of 1.8 million USD from the organization. The group claims that the attack occurred on August 4, 2025, the same day the announcement was posted on their leak site. This rapid timeline suggests a highly aggressive approach to the extortion process.

In terms of the volume of information involved, the threat actor claims that 175 GB of data has been exfiltrated from the institution's systems. While the sheer volume of the data is significant, the group has not provided specific details regarding the nature of the allegedly exfiltrated data. The available evidence provided by the group, such as screenshots, only displays the organization's name and the ransom amount requested, without further elaboration on the specific files or databases targeted.

About Diethelm Travel

Diethelm Travel is a well-established travel company operating across Asia, providing destination management and travel services. The company offers customized tours, accommodation, and logistics solutions for tourists visiting the region.

Impact assessment and industry implications

This incident may negatively impact the organization's operational continuity and reputation. Depending on the nature of the data, risks such as identity theft or targeted phishing attacks against customers and employees may emerge. As the organization is based in Thailand, potential non-compliance with local data protection regulations could be observed.

The use of double extortion tactics may increase pressure on the organization and trigger secondary security risks. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's systems to disrupt operations but also steal sensitive data to threaten its public release. This dual-layered approach forces organizations to fight on two fronts: recovering from operational downtime and managing the fallout of a data leak.

Public information regarding the Devman group is limited; therefore, a definitive assessment of their methods and past activities cannot be made. For organizations operating in the hospitality and travel sector, such incidents highlight the importance of robust data protection frameworks. Common defensive steps for organizations in this sector include maintaining rigorous offline backups, implementing multi-factor authentication across all services, and conducting regular employee training to mitigate phishing risks. Furthermore, maintaining compliance with regional data protection laws is essential to mitigate legal and regulatory repercussions following a potential breach.