pt.elis.com listed on devman ransomware leak site

• Ransomware group: devman
• Country: Portugal
• Sector: Professional Services
• Announcement date: July 20, 2025

The international service company pt.elis.com has been listed on the leak site of the ransomware group known as devman. According to the announcement made on July 20, 2025, the threat actors claim to have exfiltrated a significant volume of data from the organization and are currently demanding a ransom payment to prevent the public release of the information.

The details of the alleged attack

The threat actor identified as devman has published an entry on its dedicated leak site, claiming to have successfully compromised data belonging to pt.elis.com. The group is utilizing a high-pressure tactic by demanding a ransom of 4 million USD in exchange for not publishing the alleged stolen data. The announcement, which appeared on July 20, 2025, specifies that the volume of the exfiltrated data is 450 GB.

This type of activity is characteristic of modern ransomware operations that employ double extortion methods. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information beforehand. By threatening to leak this data on a public platform, the attackers aim to increase the pressure on the victim to pay the ransom, leveraging the risk of reputational damage and legal consequences as leverage.

Information regarding the claimed data

While the group has provided specific metrics regarding the scale of the breach, there is no detailed information regarding the specific content of the allegedly leaked data. The announcement and associated screenshots do not specify any particular file types or categories of information beyond the total data volume and the ransom amount. Consequently, the listing names no specific data types.

Potential implications of the breach

This alleged data breach may pose a significant risk to the institution's operational continuity. Because the organization is based in Portugal, a potential data breach of this nature could trigger legal obligations under the GDPR (EU General Data Protection Regulation). The exposure of sensitive information, if confirmed, could facilitate identity theft and targeted phishing attacks if employee or customer information is included in the cache.

About elis

Elis is an international service company providing textile, hygiene, and facility management solutions. It specializes in the rental and maintenance of workwear, hospitality linen, and cleaning equipment.

Risk assessment and defensive considerations

Information regarding the devman group remains limited, making it difficult to determine their specific tactics, techniques, and procedures. However, the use of double extortion is a clear indicator of an intent to maximize the impact of the attack. For organizations operating in the professional services sector, such incidents highlight the critical importance of robust data security processes.

To mitigate the risks associated with such threats, organizations typically focus on several defensive pillars:

• Data security and encryption: Implementing strong encryption for data at rest and in transit to ensure that even if data is exfiltrated, it remains unreadable to unauthorized parties.
• Access control: Enforcing the principle of least privilege to ensure that users and processes only have access to the data necessary for their specific roles, thereby limiting the scope of potential exfiltration.
• Monitoring and detection: Maintaining continuous monitoring of network traffic and data movement to identify unusual patterns that might indicate exfiltration in progress.
• Regulatory compliance: Ensuring readiness to meet legal obligations, such as notifying relevant authorities and affected individuals, in the event of a confirmed breach.

As seen in this case, the threat of a leak can create immense pressure. It is vital for institutions to review their data security frameworks and maintain a clear incident response plan to address both the operational disruption of ransomware and the legal complexities of data exfiltration.