GMA Network listed on devman leak site

• Ransomware group: devman
• Country: Philippines
• Sector: Technology
• Announcement date: May 7, 2025

The threat actor group known as devman has listed GMA Network on its leak platform. This announcement, made on May 7, 2025, suggests a potential data breach involving the organization, although the claims remain unverified by the victim.

The claims made by devman

On May 7, 2025, the devman group officially listed GMA Network on their dedicated leak site. Through this announcement, the threat actors claim they have access to information associated with the organization and state that they may potentially release this data. While the group has made these claims, public information regarding the specific identity, methods, or history of the devman group remains limited in the public domain.

The group has reportedly issued a ransom demand of 2.5 million USD in connection with this incident. This demand, combined with the threat of leaking sensitive information, suggests that the group may be employing a double extortion tactic. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to publish it unless the ransom is paid.

Details regarding the alleged leaked data

At this stage of the investigation, there is no screenshot or detailed information available regarding the nature of the alleged leaked data. The listing does not provide specific details concerning the volume of the files or the exact categories of information that have been targeted. Furthermore, the listing names no specific data types that have been compromised.

The lack of immediate evidence or specific file counts makes it difficult to determine the full scope of the incident. In many ransomware attacks, the absence of immediate data samples is common during the initial stages of a leak site announcement, as attackers often use the threat of disclosure to increase pressure on the victim.

About GMA Network

GMA Network is a leading media and broadcasting company based in the Philippines. The organization operates across multiple sectors of the media industry, including television and radio broadcasting. Additionally, the company is involved in content production and provides various digital media services to its audience.

Potential impact and organizational risks

The claims made by devman could create a negative impact on the operational continuity of GMA Network. If the data is indeed disclosed, the commercial reputation and the trust established with customers could be significantly harmed. Furthermore, the organization may face legal obligations under the data privacy laws of the Philippines depending on the nature of the information involved.

Beyond the immediate corporate impact, secondary risks may emerge if the leaked data contains sensitive information. These risks include the possibility of identity theft and the execution of targeted phishing attacks against the organization's employees or its users. Such attacks often leverage stolen credentials or personal details to gain further access to corporate networks or to defraud individuals.

In the media and technology sectors, maintaining data integrity and availability is critical for service delivery. Organizations facing such threats typically focus on strengthening their defensive postures through various measures. These include implementing robust encryption for data at rest and in transit, enforcing multi-factor authentication across all access points, and maintaining rigorous backup protocols to ensure operational resilience. Continuous monitoring and rapid incident response capabilities are also essential components of a modern cybersecurity strategy to mitigate the fallout of potential extortion attempts.