Devman ransomware group lists www.heitech.com.my on its leak site

• Ransomware group: Devman
• Country: Malaysia
• Sector: Technology
• Announcement date: November 4, 2025

The threat actor known as Devman has listed data allegedly belonging to HeiTech Padu Berhad on its leak site. According to the announcement made by the group, the breach involves a significant volume of information, and the attackers are currently demanding a ransom to prevent the public release of the stolen material.

The claims made by Devman

The Devman group announced that it has targeted HeiTech Padu Berhad via a post on its dedicated leak site. In this announcement, the threat actor claims to have successfully exfiltrated a substantial amount of information from the institution. The group has stated that the attack occurred on November 4, 2025, and they have subsequently posted a claim regarding the stolen assets.

To prevent the publication of the data, the threat actor is demanding a ransom payment of 500,000 USD. This scenario is a classic example of the double extortion tactic frequently employed by modern ransomware groups. In such attacks, the threat actor does not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the information publicly, the attackers aim to increase the pressure on the organization to meet their financial demands.

Details regarding the alleged data breach

Regarding the specifics of the incident, the Devman group has provided limited information concerning the contents of the breach. The listing identifies the total volume of the alleged theft, but it does not provide a granular breakdown of the files or the specific categories of information involved.

The following details have been provided by the threat actor:

• The total size of the claimed dataset is 60 GB.

No specific details regarding the nature of the allegedly leaked data have been provided; only the 60 GB dataset is mentioned in the group's announcement.

About HeiTech Padu Berhad

HeiTech Padu Berhad is a Malaysia-based technology services provider. The company offers a wide range of professional services, including system integration, network services, and data center solutions. Their operational scope serves both the public and private sectors, providing essential technical infrastructure and management services to a diverse client base.

Potential risks and organizational implications

This incident may pose a potential risk to the institution's operational continuity and data privacy. Depending on the nature of the leaked data, secondary risks such as identity theft or targeted phishing attacks against the institution's customers and employees may be observed. When large datasets are exfiltrated, the stolen information can be used by malicious actors to craft highly convincing social engineering campaigns or to impersonate individuals within the organization.

Furthermore, the legal and regulatory implications for a technology provider in this region are significant. Under Malaysia's Personal Data Protection Act (PDPA), the institution's data breach notification obligations and potential administrative sanctions may come into play. Organizations operating in the technology and services sector must remain vigilant regarding their compliance with local privacy laws to mitigate legal exposure following a breach.

While public information about the Devman group remains limited, the use of double extortion highlights the evolving sophistication of ransomware operations. To defend against such threats, organizations typically focus on robust backup strategies, strict access controls, and continuous monitoring of their network environments to detect unauthorized data exfiltration. Maintaining a comprehensive incident response plan is also a critical component of modern cybersecurity posture to manage the fallout of potential data leaks.