Devman ransomware group lists www.hameshakem.co.il on its leak site

• Ransomware group: Devman
• Country: Israel
• Announcement date: October 3, 2025

Devman claims data exfiltration from HaMeshakem

The threat actor known as Devman has listed the Israeli organization HaMeshakem on its dedicated leak site. According to the announcement made on October 3, 2025, the group claims to have successfully exfiltrated a significant amount of data from the organization's networks. This incident follows a pattern of double extortion, a tactic where ransomware groups not only encrypt an organization's systems but also steal sensitive information to use as leverage during negotiations.

The threat actor alleges that the breach occurred on the same day the announcement was posted, October 3, 2025. Along with the claim of data theft, Devman has issued a ransom demand of 6,000,000. The leak site listing includes a countdown timer, a common psychological tactic used by ransomware groups to pressure victims into paying the demanded sum before the threat of data publication becomes imminent.

Details of the alleged data theft

While the group has provided specific metrics regarding the scale of the breach, the nature of the stolen information remains unclear. The announcement specifies the volume of the data but does not categorize the content. Specifically, the group claims the following regarding the exfiltrated information:

• The total size of the claimed exfiltrated data is 400 GB.

The listing does not provide detailed information regarding the specific nature or types of the alleged exfiltrated data; it is only stated to be 400 GB in size. There is no further breakdown of the file types or the specific databases that may have been accessed during the intrusion.

About HaMeshakem

HaMeshakem is an Israel-based law and mediation firm. The company operates in the field of legal dispute resolution and mediation services. Given the nature of their professional services, the organization handles sensitive legal matters and mediation processes for its clients.

Potential impact and organizational risks

This incident may result in the exposure or sale of the organization's sensitive data. Should the data contain personal or commercial information, legal proceedings under Israeli data protection regulations could be initiated. The organization may face secondary risks such as identity theft or targeted phishing attacks resulting from the potential leak.

In such scenarios, organizations often face significant challenges. If the ransom demand is not met, it is possible that the data will be published on public platforms by the threat actor. This can lead to long-term reputational damage and loss of client trust. Information about the Devman group remains limited, making it difficult for defenders to attribute the attack or predict specific group behaviors beyond their standard extortion methods.

To mitigate risks associated with such threats, organizations typically focus on robust defensive postures. This includes maintaining regular, offline backups to ensure data availability and implementing strict access controls to limit the movement of attackers within a network. Furthermore, monitoring for large-scale data transfers can help detect exfiltration attempts in real-time. As ransomware groups continue to use leak sites to exert pressure, the risk of data being made public remains a primary concern for victimized entities.