devman ransomware group lists forestry.gov.jm on its leak site

• Ransomware group: devman
• Country: Jamaica
• Sector: Government & Defense
• Announcement date: October 10, 2025

The Forestry Department of Jamaica (forestry.gov.jm) has been listed on the leak site of the ransomware group known as devman. The threat actor claims to have compromised data belonging to the institution and has published a formal ransom notice as of October 10, 2025.

The details of the claimed attack

According to the announcement made by the devman group, the organization has been targeted in a cyberattack. The group has issued a ransom demand of 200,000 USD from the institution. To increase the pressure on the victim, the attackers have implemented a countdown timer, setting a specific deadline for the publication of the alleged data if the demands are not met.

This tactic is a hallmark of modern ransomware operations. By using a countdown timer, threat actors create a sense of urgency and psychological pressure, hoping to coerce the victim into paying the ransom before the deadline expires. This method is often used to prevent the victim from having sufficient time to coordinate a response or conduct a thorough forensic investigation.

Information regarding the leaked data

At this time, no specific information regarding the content of the leaked data has been provided by the attackers. The available evidence, such as screenshots provided by the group, only displays the ransom demand and the countdown timer. Consequently, the listing names no specific data types that have been compromised.

The organization profile

The Forestry Department of Jamaica is the official government agency responsible for the sustainable management, conservation, and development of the country's forest resources. As a government entity, it plays a critical role in the environmental and natural resource management of the nation.

Analysis and implications for the sector

This incident suggests that cyberattacks against government institutions may threaten the continuity of public services and data security. Given the nature of the institution, the potential exposure of sensitive data could lead to risks such as identity theft or corporate espionage. Furthermore, the institution may face legal obligations under Jamaican data protection regulations due to the potential impact on data privacy.

The use of both a ransom demand and a countdown timer indicates that the group may be employing a double extortion strategy. In a double extortion scenario, attackers do not merely encrypt files to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this data publicly serves as secondary leverage, ensuring that even if the organization can restore systems from backups, they still face the risk of public exposure and regulatory penalties.

For organizations within the government and defense sector, such incidents highlight the necessity of robust cybersecurity frameworks. To defend against these types of threats, organizations typically focus on several key areas:

• Data encryption: Ensuring that sensitive data is encrypted both at rest and in transit to mitigate the impact of exfiltration.
• Regular backups: Maintaining offline or immutable backups to ensure service continuity in the event of a ransomware encryption event.
• Access control: Implementing strict identity and access management to limit the lateral movement of attackers within a network.
• Incident response planning: Developing and testing comprehensive response plans to handle the complexities of extortion and data leaks.

While information about the devman group remains limited, the targeting of a national agency underscores the ongoing risk posed by ransomware groups to public infrastructure and the sensitive information they manage.