Kavi.fi listed on devman leak site

• Ransomware group: devman
• Country: Finland
• Sector: Professional Services
• Announcement date: December 25, 2025

The threat actor known as devman has listed the Finnish organization kavi.fi on its dedicated leak site. According to an announcement published by the group, the entity has been targeted in a cyberattack, with the threat actor claiming that sensitive information has been compromised.

The claim by devman

The devman group published an announcement on December 25, 2025, claiming that data belonging to kavi.fi has been exfiltrated. This announcement appeared on the group's leak site, marking a public claim of a successful breach against the organization. While the group has made this claim, it is important to note that the information is based on the group's own post on their platform.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release stolen data publicly, these groups attempt to pressure the victim into paying a ransom. The use of a leak site serves as a public notification of the breach, often intended to cause reputational damage or regulatory scrutiny for the targeted entity.

The alleged data involved

The post made by the devman group indicates that the exfiltrated information specifically pertains to the internal administrative operations of the organization. The claim suggests that the breach involves sensitive records related to the workforce of the entity.

Affected data types

• Employee HR data

No specific details were provided regarding the total volume of the data, the exact number of files involved, or the specific nature of the human resources records. Furthermore, the group has not issued a ransom demand, and no information was provided regarding the total size of the data exfiltrated.

About kavi.fi

KAVI (National Audiovisual Institute) is a Finnish government agency operating under the Ministry of Education and Culture. The institute holds significant responsibilities regarding the country's media and cultural heritage. Its primary duties include media literacy education, the classification of films, and the preservation of audiovisual cultural heritage within Finland.

Analysis and potential implications

This leak claim may pose a significant risk of exposure for the personal data of the organization's employees. The compromise of human resources data is a serious matter, as it could lead to secondary risks such as identity theft and targeted phishing attacks against staff members. When HR records are exposed, attackers often use the personal details found within them to craft highly convincing social engineering attacks or to commit fraud.

Because the organization operates in Finland, the incident may be subject to evaluation under EU GDPR regulations regarding data protection breaches. Such regulations require organizations to maintain high standards of data protection and to report significant breaches to the relevant regulatory authorities. Organizations facing such risks typically need to review their data security processes and ensure they are following proper notification protocols for both regulators and affected individuals.

Public information regarding the devman group remains limited, which means that no definitive conclusions can be drawn regarding their specific methods or their underlying motivations for this particular attack. In the professional services and government sectors, maintaining robust defensive measures is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized data exfiltration. Organizations in this sector are often encouraged to adopt a zero-trust architecture to limit the lateral movement of attackers within their networks.