Quezon Power targeted in alleged data leak by devman

• Ransomware group: devman
• Country: Philippines
• Sector: Energy & Utilities
• Announcement date: December 12, 2025

A data leak announcement targeting Quezon Power

A data leak announcement targeting Quezon Power has been published on a leak site by the group known as devman. The announcement, which was posted on December 12, 2025, claims that the organization has been the victim of a cyberattack. This type of activity is common in modern ransomware campaigns, where threat actors utilize leak sites to pressure organizations through the threat of public exposure.

The devman group has listed data allegedly belonging to Quezon Power on their leak site. According to the announcement, the group claims that data related to the institution's operational and administrative processes has been compromised. The group states that the attack occurred on December 10, 2025. While the group has made these claims, no screenshots were provided in the announcement to verify the contents of the alleged breach.

Claims regarding the scope of the breach

The announcement makes several specific claims regarding the types of information that have been exfiltrated during the alleged incident. The group asserts that the breach includes a variety of sensitive files ranging from administrative records to technical system data. The specific categories of data mentioned in the claim include:

• Employee data
• HR information
• Project files
• Work logs
• SCADA system data

At this time, there is no information available regarding the total size of the data stolen or the specific number of files involved. Furthermore, no ransom demand has been specified by the group in the public announcement.

About Quezon Power

Quezon Power is an energy company that operates a coal-fired power plant located in the Quezon province of the Philippines. It plays a critical role in providing power to the regional electrical grid.

Risk assessment and implications

This alleged leak may pose a risk of identity theft due to the exposure of personal employee information. When sensitive HR and employee data are compromised, individuals within the organization may face long-term risks regarding their personal privacy and financial security. Additionally, the presence of data allegedly belonging to SCADA systems could create secondary risks for the institution's operational security and potentially facilitate targeted attacks against the infrastructure.

The organization may face legal obligations under Philippine data privacy regulations following such an incident. It is important to note that information regarding the devman group is limited; therefore, no definitive assessment can be made regarding their specific methods or motivations. The accuracy and scope of the alleged data may become clearer following the institution's internal investigation.

In the broader context of cybersecurity, such incidents highlight the evolving nature of double extortion tactics. In these scenarios, attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations. For organizations in the energy and utilities sector, protecting both administrative networks and Industrial Control Systems (ICS) is a primary defensive priority. Common defensive steps for organizations include implementing strict network segmentation to isolate SCADA environments from corporate networks, enforcing multi-factor authentication, and maintaining robust, offline backups to ensure operational continuity.