h*i**c*.c*m.my Listed by devman Ransomware Group

On October 28, 2025, the Malaysian healthcare provider hicc.com.my appeared on the leak site of the ransomware group Devman. The attackers claim to have stolen 60 GB of internal files and are demanding a $500,000 ransom.

What Public Reporting Shows

Available reporting describes the incident as a ransomware attack in which Devman exfiltrated internal documents before encrypting systems. The group published a sample of the stolen data on its onion site, listing the victim as hicc.com.my. No confirmed total number of affected individuals has been released, but healthcare providers routinely hold sensitive patient records, employee payroll files, insurance details, and internal correspondence. The ransom demand stands at $500,000, with the data volume listed as 60 GB.

Why This Matters for You and Your Family

When a healthcare organization loses control of internal files, the information inside often includes names, addresses, dates of birth, national identification numbers, medical histories, and sometimes banking details for direct-debit payments. If your family has ever used this provider, any of those records could now sit in an attacker’s archive. Once that data reaches underground markets, it becomes raw material for identity theft, insurance fraud, or targeted scams against you or your children. The breach also signals that even mid-sized regional clinics remain attractive targets, meaning families must assume their own records could surface without warning.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain spreadsheets that link patient names to email addresses, phone numbers, next-of-kin contacts, and sometimes employee login credentials. Attackers chain these fragments together: an email from one record matches a reused password from another breach, a phone number ties to a child’s gaming account, and suddenly a single leak becomes a complete profile. Public reporting indicates that credential leaks like this one routinely cascade into account takeovers across email, banking, and gaming platforms. Children’s gaming accounts are especially vulnerable because parents often reuse the same passwords or security questions drawn from family medical or address records.

Devman’s Publicly Known Track Record

Public reporting attributes Devman’s emergence to mid-2024. The group has claimed responsibility for attacks on healthcare providers, logistics companies, and small-to-medium manufacturers. Its typical playbook begins with initial access gained through phishing or exploited remote desktop services, followed by exfiltration of sensitive folders before encryption. Extortion follows a double-pressure model: the group threatens both data publication and operational disruption, often setting short payment deadlines and releasing small samples to demonstrate possession. The exact scale of prior victims remains under active tracking by ransomware intelligence platforms.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of data broker listings tied to the breach.
• Rotate any password you ever used at hicc.com.my or related healthcare portals anywhere else it appears, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your family’s data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and parent emails now at risk.
• Let remediation specialists handle ongoing takedown requests for any exposed personal documents or listings that surface from this incident.

The incident shows that healthcare data leaks continue at pace and that waiting for confirmation your records were taken is no longer a viable strategy. One practical forward step is to treat every new breach as a prompt to lock down the connections attackers exploit. DoxxScan by GalaxyWarden delivers that protection through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Families who act quickly can shrink the window between exposure and response.