sacada.org listed on devman ransomware leak site

• Ransomware group: devman
• Country: United States
• Announcement date: September 29, 2025

The ransomware group known as devman has listed sacada.org on its leak site, claiming to possess data belonging to the organization. This announcement, which appeared on the group's platform on September 29, 2025, marks a potential data breach incident involving the non-profit entity.

Details of the claim

According to the announcement posted by the devman group, the organization sacada.org has been targeted in a cyberattack. The group claims to have obtained data belonging to the entity and is using this as leverage for extortion. The listing indicates that a ransom demand of 100,000 USD has been issued by the attackers to the organization.

Ransomware attacks of this nature often follow a pattern known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public leak site serves as additional pressure to compel the victim to pay the ransom. While the listing is a claim made by the devman group, it highlights the increasing trend of attackers targeting non-profit organizations to exploit the sensitive nature of the information they manage.

Information regarding the alleged leaked data

Regarding the specifics of the breach, there is no information available regarding the nature of the alleged leaked data. The listing does not specify the types of files, the volume of data, or the specific databases that have been compromised. Consequently, the listing names no data types.

Organizational profile

SACADA (Substance Abuse Council of Adams County) is a non-profit organization based in Adams County, Washington. The organization is dedicated to substance abuse prevention and community awareness programs within the region.

Risk assessment and implications

This incident may indicate a risk of sensitive data exposure or encryption for the organization. Given that the entity is based in the United States, a potential data breach could result in legal obligations under HIPAA or state-level data protection regulations. The sensitive nature of the services provided by a substance abuse council suggests that any exposure of data could have significant implications for the privacy of individuals involved in their programs.

The publication of such data may lead to identity theft or targeted phishing attacks against employees and service recipients. When personal information is leaked, attackers often use it to craft highly convincing social engineering campaigns, making it difficult for individuals to distinguish between legitimate communications and fraudulent ones.

Public information regarding the devman group is limited; therefore, a definitive assessment of the group's methods and motivations cannot be made. In general, organizations facing such threats can benefit from implementing robust defensive measures. These include maintaining offline backups, enforcing multi-factor authentication across all services, and conducting regular security awareness training for staff to recognize phishing attempts. Furthermore, maintaining a comprehensive incident response plan is a critical step for organizations to mitigate the impact of potential breaches and ensure compliance with regulatory requirements.