Hopital La Rabta listed on devman ransomware leak site

• Ransomware group: devman
• Country: Tunisia
• Sector: Healthcare
• Announcement date: December 12, 2025

The healthcare institution Hopital La Rabta has been listed on the leak site of the devman ransomware group. This announcement, made on December 12, 2025, indicates that the institution's digital assets may have been targeted by threat actors.

The claims made by the devman group

According to the announcement published by the devman group, the attackers claim to have gained unauthorized access to the systems of Hopital La Rabta. The group posted the listing on their dedicated leak site on December 12, 2025, following a claimed attack date of December 11, 2025.

In modern cyberattack trends, ransomware groups often employ a strategy known as double extortion. In this scenario, threat actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption phase. The goal is to threaten the victim with the public release of this data on a leak site if a ransom is not paid. This tactic places immense pressure on organizations, as the exposure of private information can lead to significant reputational damage and legal consequences, regardless of whether the systems are successfully restored from backups.

Details regarding the alleged data leak

Regarding the specifics of the breach, the listing provides very limited information. No screenshots or detailed information regarding the nature of the allegedly leaked data have been provided by the group. Furthermore, the group has not disclosed the total size of the data or the specific file count involved in the incident. There is also no information available regarding a ransom demand.

The listing names no specific data types that have been compromised.

About Hopital La Rabta

Hôpital La Rabta is a well-established public hospital located in Tunis, the capital of Tunisia. As one of the country's major healthcare centers, it provides services across various medical specialties.

Implications and defensive considerations

This incident suggests that the institution may be at risk regarding patient records and sensitive medical information. If a data breach has occurred, it could lead to violations of local data protection regulations and the compromise of patient privacy rights. Furthermore, the leaked data could potentially be utilized for secondary attacks, identity theft, or targeted phishing campaigns.

Information about the devman group is limited. In such cases, it is often advisable for the affected institution to review its security measures against potential data breaches and notify relevant authorities. For organizations operating within the healthcare sector, maintaining robust cybersecurity postures is critical due to the high value of medical data on the dark web. Common defensive steps for such organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access.

Summary of the incident

• Organization: Hopital La Rabta
• Ransomware Group: devman
• Claimed Attack Date: 2025-12-11
• Announcement Date: 2025-12-12
• Sector: Healthcare
• Location: Tunisia