d*v***.cl Listed by devman Ransomware Group

On December 18, 2025, the ransomware group Devman listed medical provider d*v***.cl on its leak site and began publishing patients’ full records, HIV test results, and IDs stolen during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates the incident involved exfiltration of internal files containing sensitive health information. The data includes complete patient records, HIV test results, and identification documents. The group posted the material on its dark-web leak site, a common tactic used to pressure victims. Available reporting describes the breach as high severity due to the deeply personal nature of the records. Exact number of affected patients remains unknown at this time.

Why This Matters for You and Your Family

When medical records leave a clinic’s control, they do not just expose your health history. They expose names, addresses, dates of birth, national IDs, and test results that can be used for identity theft, insurance fraud, or blackmail. HIV test results are especially sensitive; their public release can lead to stigma, employment discrimination, or family conflict. If you or anyone in your household has ever visited this provider, your information may now sit in criminal databases. Children listed on family accounts are equally exposed because their records often share the same address and parent contact details.

The Doxxing and Identity-Chain Implications

Health data rarely travels alone. A single leaked email or phone number links to gaming accounts, social-media handles, and school records. Attackers follow these chains to build full profiles. Credential leaks like this one frequently cascade into account takeovers on Steam, Roblox, or Discord, where children’s usernames and passwords are reused. Once an attacker controls a family gaming account, they can harvest additional personal details and expand the doxxing campaign. The combination of medical stigma and digital footprints creates a powerful extortion playbook.

Devman’s Publicly Known Track Record

Public reporting attributes Devman’s emergence to mid-2024. The group has targeted healthcare providers, municipalities, and small-to-medium businesses. Its typical playbook begins with initial access through phishing or exploited remote desktop services, followed by data exfiltration and deployment of ransomware. When payment is not received, Devman publishes samples on its leak site and threatens to release the full archive. Past victims include organizations whose patient and employee records appeared in similar extortion campaigns. Exact success rate is difficult to verify, but the group maintains an active presence on multiple dark-web forums.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by specialists.
• Rotate the password used at d*v***.cl anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household — DoxxScan family coverage extends to dependents and children’s gaming accounts that often chain back to the same leaked address and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your accounts.

The speed with which stolen medical data spreads means waiting for notifications is no longer enough. Start with concrete steps today and maintain ongoing visibility into where your family’s information appears. DoxxScan by GalaxyWarden delivers that continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for both adults and children’s gaming accounts.