eehc.gov.eg Listed by devman Ransomware Group

On July 15, 2025, the Egyptian Electricity Holding Company website eehc.gov.eg appeared on the leak site of the ransomware group known as devman, with the attackers demanding a $2.27 million ransom after exfiltrating internal files.

What's Publicly Reported from Reporting

Public reporting indicates that devman claims to have breached the Egyptian government-linked electricity provider and stolen sensitive internal documents. The listing on the group’s dark-web leak page includes a sample of the allegedly stolen data, though the exact number of people whose personal information was exposed remains unknown. Available reporting describes the incident as a classic ransomware double-extortion attack in which the group first encrypts systems and then threatens to publish stolen files unless the ransom is paid.

Internal files were allegedly exfiltrated, according to the leak-site posting. No independent verification of the data volume or specific record types has been published, but government agencies and utility providers routinely hold names, national ID numbers, addresses, contact details, billing records, and employee payroll information.

Why This Matters for You and Your Family

When a utility company that supplies electricity to millions of households is breached, the ripple effects reach ordinary families. If your name, address, phone number, or government ID appears in the stolen files, criminals can use that information to file fraudulent accounts, impersonate you to utilities or banks, or sell it to other threat actors. Children’s records held by a family-linked account can also be exposed, creating long-term risks that grow quietly until identity theft or harassment begins.

Utility customer data is especially dangerous because it ties your real-world address to digital identities. Once criminals know where you live and which services you use, they can launch convincing phishing campaigns or SIM-swapping attempts that feel personally targeted.

The Doxxing and Identity-Chain Implications

Stolen utility records rarely stay isolated. A single leaked email or phone number can be correlated with gaming accounts, social-media handles, and family-member profiles to build a complete identity chain. Attackers then move from simple data sales to full doxxing—publishing addresses, family names, and children’s usernames across forums. Credential leaks of this kind frequently cascade into account takeovers on Steam, Roblox, or other gaming platforms where children often reuse passwords or security questions derived from family information.

Because the data originates from a government-affiliated utility, the breach may also contain employee or contractor records that overlap with household accounts, widening the exposure surface for every family member.

Devman’s Publicly Known Track Record

Public reporting attributes devman’s emergence to early 2024. The group has targeted healthcare providers, educational institutions, and government-adjacent organizations in multiple countries. Its typical playbook begins with initial access through phishing or exploited remote-desktop services, followed by rapid exfiltration of documents before encryption. Extortion demands are issued privately, then followed by public leak-site postings that include sample data to pressure victims. Devman’s ransom notes usually set short deadlines measured in days, and the group has shown willingness to release additional batches of data when payments are not made.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate the password you used at any Egyptian government or utility service anywhere it has been reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is caught within hours instead of months.
• Cover the entire household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become the next link in doxxing chains after credential leaks like this one.
• Let DoxxScan remediation specialists handle takedown requests for any exposed personal records appearing on data-broker or underground sites.

The speed with which ransomware groups move stolen data means ordinary families must act faster than the attackers. Starting with a clear map of your exposed information and maintaining continuous oversight gives you the best chance of stopping identity theft or doxxing before it reaches your doorstep. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.