Inter care listed on devman leak site

• Ransomware group: devman
• Country: United States
• Sector: Healthcare
• Announcement date: December 9, 2025

Inter care listed on devman leak site

The healthcare organization Inter care has been listed on a leak site by the threat actor group known as devman. According to an announcement published by the group, the organization has been targeted in a cyberattack that allegedly resulted in the theft of sensitive information.

Details of the claimed attack

The devman group published an announcement on December 9, 2025, claiming to have compromised data belonging to Inter care. The threat actor alleges that they gained access to the organization's networks and exfiltrated various datasets. This announcement was made via the group's leak platform, which is a common tactic used in modern cyber extortion campaigns.

In many contemporary ransomware scenarios, threat actors employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also focus on exfiltrating sensitive data before the encryption phase. Once the data is stolen, the attackers threaten to publish it on public leak sites if their demands are not met. This adds a significant layer of pressure on the victim, as the exposure of private information can cause long-term reputational and legal damage even if the organization can restore its systems from backups.

The specific details regarding the timing of the initial compromise suggest the attack may have occurred on December 8, 2025, according to the claims made by the group. While the group has made these claims publicly, no screenshots were provided to substantiate the theft at the time of the announcement.

Data allegedly exfiltrated

The announcement made by devman claims the exfiltration of several types of sensitive information. While the total volume of data and the specific number of files involved remain unknown, the group has identified the following datasets as being part of the breach:

• Patient data
• Financial data
• QuickBooks database

The loss of such data types is a critical concern for any organization, particularly when it involves a combination of financial records and personal health information. The presence of a full QuickBooks dump suggests that the attackers may have targeted core business and accounting functions to maximize the impact of the extortion attempt.

About Inter care

Inter care is a healthcare provider based in the United States. The company operates in the field of patient care and related medical support services.

Potential impact and industry implications

This incident may pose a risk of exposure for the organization's financial and personal health records. Given the organization's operation in the healthcare sector, the breach could potentially lead to regulatory consequences under frameworks such as HIPAA. Healthcare organizations are high-value targets for cybercriminals because the data they manage is highly sensitive and carries significant value on the dark web.

The publication of this data may create secondary risks for individuals, including identity theft and fraud. When personal identifiers or medical histories are leaked, the individuals affected may face prolonged periods of monitoring and potential financial loss. Furthermore, the group responsible for this listing, devman, has limited information available in the public domain, making it difficult to assess their specific tactics, techniques, and procedures.

For organizations operating in the healthcare sector, such incidents highlight the necessity of robust defensive measures. Common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular network segmentation to limit lateral movement by attackers. Additionally, organizations often must initiate data breach notification procedures and inform the affected parties to comply with legal requirements and mitigate harm to individuals. The complexity of these breaches requires a coordinated response involving IT security, legal counsel, and regulatory compliance teams.