Fassic.org data allegedly leaked by devman ransomware group

• Ransomware group: devman
• Country: France
• Sector: Healthcare
• Announcement date: December 9, 2025

Devman group claims data breach at fassic.org

The threat actor known as devman has published an announcement on their leak site claiming that data belonging to fassic.org has been leaked. The announcement, which was created on December 9, 2025, alleges that the group has successfully exfiltrated various types of sensitive information from the organization.

This type of activity is characteristic of modern ransomware operations, often involving a strategy known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release this information on public leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential records.

According to the claim, the breach occurred around December 6, 2025. While the group has posted an announcement regarding the leak, they have not provided any screenshots to verify the authenticity of the stolen data. Furthermore, there is no information available regarding the total size of the data stolen, the specific number of files involved, or the amount of ransom demanded by the group.

Details of the alleged data leakage

The announcement made by devman specifies that the stolen information includes several categories of sensitive documents. The group alleges that they have obtained access to critical records that could pose significant privacy risks if released. The specific types of data mentioned in the claim include:

• Financial records
• Medical cards
• HR documents

The presence of medical cards is particularly concerning in a cybersecurity context. In many jurisdictions, medical information is treated with the highest level of protection due to its sensitive nature. When such data is compromised, it can lead to severe consequences for the individuals involved, as it contains private health information that is highly valued by malicious actors.

Implications and potential risks

This incident may result in the exposure of the organization's sensitive data to third parties, posing a significant risk to data privacy. Because the leaked information allegedly includes medical cards, this data could be classified as special category personal data under the General Data Protection Regulation (GDPR). Such a classification means that the organization may face legal sanctions and regulatory scrutiny following the breach.

Beyond the immediate privacy concerns, there are significant secondary risks associated with the leakage of financial and personal data. Such information is frequently utilized by cybercriminals to conduct identity theft or to launch highly targeted phishing attacks against the affected individuals. By having access to HR documents and financial records, attackers can craft more convincing social engineering campaigns to further exploit the organization or its employees.

For organizations operating within the healthcare sector, such incidents highlight the critical importance of robust data protection frameworks. To mitigate these risks, organizations typically need to fulfill legal obligations, such as data breach notification requirements, and ensure that all affected parties are informed of the exposure. Maintaining strict access controls, implementing comprehensive encryption for data at rest and in transit, and conducting regular security audits are standard defensive steps used to protect against such unauthorized access. At this time, information regarding the devman group remains limited.