devman ransomware group lists www.nijar.es on its leak site

• Ransomware group: devman
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: May 25, 2025

The devman group claims a breach of Níjar City Council

The threat actor known as devman has listed the organization www.nijar.es on a dedicated leak site. This announcement, which appeared on May 25, 2025, marks a significant claim of a data breach targeting the institution. While the listing confirms the organization's presence on the site, the group's public profile and specific operational details remain limited in the public domain.

In the landscape of modern cyber threats, ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The threat of releasing this stolen information on a public forum serves as a secondary layer of leverage to compel the victim into paying a ransom. Such tactics pose a severe risk to the confidentiality and integrity of organizational data.

Details of the alleged data exfiltration

According to the claims made by the devman group, the attack occurred on May 25, 2025. The threat actor alleges that they have successfully accessed the institution's network and exfiltrated a significant amount of information. The group claims that the volume of data obtained from the network is approximately 120 GB.

Despite the claim regarding the total size of the data, the announcement lacks specific details regarding the nature of the files. There is no screenshot or detailed description available regarding the content of the allegedly leaked data. Furthermore, the listing does not specify the number of files involved or the specific types of data that were targeted during the operation. The listing names no specific data types.

About the Níjar City Council

The target of this alleged attack is the Níjar City Council, a local government entity located in the province of Almería, Spain. As a local administrative body, the council is responsible for managing public services and overseeing local administrative processes within its region. Because it functions as a public service provider, the organization handles various administrative and community-related data to fulfill its governmental duties.

Implications and potential risks

This claim may indicate potential vulnerabilities in the institution's data security processes. If the data has indeed been compromised, there are several significant risks that must be considered. Given the institution's role, trade secrets and operational information within the agriculture and food production sector could be at risk. The security of such information is vital for maintaining the integrity of regional economic activities.

Furthermore, because the institution is based in Spain, a potential data breach could lead to legal consequences under the EU General Data Protection Regulation (GDPR). Compliance with these regulations is essential for government entities to protect the privacy rights of individuals. If the leaked data includes employee or customer information, it could create a basis for identity theft or targeted phishing attacks, where attackers use stolen details to deceive individuals or gain further access to secure systems.

To mitigate such risks, organizations often implement defensive measures such as multi-factor authentication, regular security audits, and robust encryption for data at rest and in transit. In the event of a suspected breach, it is common practice for organizations to conduct an independent audit to review their systems and notify the affected parties to minimize harm. The situation described by devman highlights the ongoing necessity for continuous monitoring and proactive security management to defend against evolving cyber threats.