devman ransomware group lists www.paragonradiology.com on its leak site

• Ransomware group: devman
• Country: United States
• Sector: Healthcare
• Announcement date: May 23, 2025

The threat actor group devman claims to have compromised Paragon Radiology

The threat actor group known as devman has announced that it has targeted Paragon Radiology, a healthcare services provider based in the United States. According to a claim posted on a ransomware leak site on May 23, 2025, the group asserts that they have successfully compromised data belonging to the organization. As of the time of this report, the group's specific identity and background information remain limited.

This incident follows a growing trend of ransomware groups targeting critical infrastructure and sensitive sectors. Ransomware attacks often involve a process where attackers gain unauthorized access to a network, exfiltrate sensitive information, and then demand payment to prevent the public release of that data. This specific claim is currently being treated as a threat claim, as further evidence regarding the validity and scope of the incident has not yet been provided.

Details of the ransom demand and the alleged attack

The devman group officially announced their targeting of www.paragonradiology.com on May 23, 2025. In their announcement, the threat actor has issued a ransom demand of 200,000 USD. This demand is made in exchange for the group's promise not to publish the alleged data on their leak site.

The nature of the attack and the specific methods used by the group to infiltrate the network have not been detailed in the public announcement. Furthermore, the group has not provided any screenshots or detailed information regarding the specific nature of the allegedly compromised data. At this stage, the listing names no specific data types that have been stolen.

The demand for a payment to prevent data publication is a hallmark of a double-extortion strategy. In such scenarios, attackers do not merely encrypt files to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the data, the attackers increase the pressure on the victim organization to comply with the ransom demand, regardless of whether the organization has backups to restore their systems.

About Paragon Radiology

Paragon Radiology is a radiology services provider located in Arizona, United States. The organization operates within the healthcare sector, offering specialized radiology reading and diagnostic services to various hospitals and healthcare facilities.

Potential risks and implications for the healthcare sector

The claim made by devman poses significant risks to patient privacy and data security, particularly given the sensitive nature of the operations conducted by a radiology services provider. Because the organization handles diagnostic and medical services, the potential exposure of medical information carries heavy implications.

Should the alleged data be leaked, the organization could face several consequences, including legal proceedings and administrative sanctions under HIPAA regulations. The Health Insurance Portability and Accountability Act (HIPAA) mandates strict protections for sensitive patient health information, and failures in data security can lead to significant regulatory oversight and penalties.

Beyond the immediate legal and regulatory concerns, secondary risks are a major concern for both the organization and its clients. These risks include:

• Identity theft targeting patients or employees.
• Targeted phishing attacks directed at employees or patients.
• Loss of trust from healthcare facilities and patients.

For organizations operating in the healthcare sector, maintaining robust defensive postures is essential. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for all staff members. Additionally, maintaining offline, encrypted backups and implementing strict network segmentation can help mitigate the impact of an intrusion. Until the validity of the devman claim is confirmed, the situation remains a serious threat claim that highlights the ongoing risks faced by healthcare providers.