ctfc.cat Listed by Devman Ransomware Group

On November 12, 2025, the Catalan Federation of Tennis Clubs (ctfc.cat) appeared on the leak site of the devman ransomware group after 30 GB of internal files were allegedly exfiltrated. The attackers are demanding a ransom of $248,000 and have published a sample of the stolen data as proof.

What Public Reporting Shows

Public reporting indicates that devman claims to have breached the tennis federation’s systems and removed 30 GB of internal documents. The group posted the organization on its dark-web leak page, listing a $248,000 ransom demand. No exact number of individuals whose data may have been exposed has been confirmed, but the nature of federation records typically includes membership details, contact information, financial records, and administrative files. The incident follows the group’s standard pattern of exfiltrating data before encrypting systems or threatening public release.

Why This Matters for You and Your Family

When sports clubs, community organizations, or local federations are breached, the people affected are usually ordinary families. Your name, address, phone number, email, date of birth, or children’s activity records may now sit in a 30 GB bundle that criminals are willing to sell or publish. Once that information leaves a trusted organization, it can appear on multiple underground markets within days. Credential leaks like this one frequently cascade into account takeovers on email, banking, or social media, putting your family’s privacy and finances at risk.

The Doxxing and Identity-Chain Implications

A single breach rarely stays isolated. Attackers map connections between an email address found in the ctfc.cat files, usernames on gaming platforms, linked social-media accounts, and phone numbers. These identity chains allow them to build detailed profiles for doxxing, targeted phishing, or identity theft. Public reporting describes how such leaks often lead to children’s gaming accounts being hijacked because parents reuse passwords or security questions tied to family details. The exposed data becomes raw material for long-term harassment or fraud that can continue for months or years after the initial incident.

Devman Group’s Known Track Record

Public reporting attributes the devman ransomware group with emerging in recent years and focusing on mid-sized organizations across Europe and North America. Notable prior victims include various private companies and associations where the group followed a consistent playbook: gain initial access, exfiltrate data, deploy ransomware, then threaten to publish the stolen files unless the ransom is paid. Their extortion style relies on public leak sites to pressure victims, often releasing small samples to demonstrate the volume and sensitivity of the data. Exact details of their initial-access methods remain limited in open sources, but the group consistently exfiltrates substantial file volumes before issuing ransom demands in the low-to-mid six-figure range.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you used on ctfc.cat or any related tennis-club site, and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same leaked address or email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The ctfc.cat breach is a reminder that data belonging to ordinary community organizations can quickly become fuel for identity crimes that reach your doorstep. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.