pt.elis.com Listed by devman Ransomware Group

On July 20, 2025, the ransomware group Devman listed pt.elis.com on its leak site and demanded a $4,000,000 ransom after exfiltrating internal files from the Portuguese subsidiary of global facilities services company Elis.

What's Publicly Reported from Reporting

Public reporting indicates that Devman claims to have stolen internal documents during a ransomware attack on pt.elis.com. The leak site posting, first noted on ransomware tracking platforms, shows the actor threatening to publish the data if the ransom is not paid. No confirmed total number of individuals affected has been released, but the nature of the stolen material — internal files — suggests employee records, vendor contracts, and operational data may be included. Elis has not yet issued a public statement confirming the breach or detailing the exact data types exposed.

The incident follows the group’s typical pattern of exfiltrating sensitive files before encrypting systems or threatening public disclosure. Available reporting describes the leak page as active on an onion domain, a standard practice for ransomware operators seeking to pressure victims while limiting mainstream visibility.

Why This Matters for You and Your Family

When a company like Elis suffers a breach, the information stolen often includes personal details that can be used against ordinary people. If you or a family member work at Elis, use their services, or appear in vendor records, your name, address, contact information, or employment data could now sit in a criminal database. Internal files frequently contain spreadsheets with customer or employee information that criminals later sell or weaponize.

Even when victim counts remain unknown, the risk is personal. A single exposed email or phone number can lead to phishing attempts, identity theft attempts, or unwanted contact that affects your household. Children’s information linked through a parent’s work records can also surface in follow-on attacks.

The Doxxing and Identity-Chain Risks

Stolen internal files rarely stay isolated. Criminals combine them with data from previous breaches to build detailed profiles. One leaked work email can link to your personal accounts, social media handles, and even your home address. This process, known as identity chaining, turns a corporate breach into a roadmap for doxxing.

Credential leaks like this one often cascade into account takeovers. If passwords or hints appear in the exfiltrated files, attackers can test them across gaming platforms, email services, and shopping sites. Gaming accounts belonging to you or your children are especially vulnerable because they frequently reuse credentials and hold payment information or voice chat logs that reveal real identities.

Devman’s Publicly Known Track Record

Public reporting attributes Devman’s emergence to early 2025. The group has targeted mid-sized organizations across Europe and North America, focusing on companies in services, manufacturing, and logistics. Notable prior victims include several unnamed European firms whose data appeared on the same leak site after ransom demands ranging from hundreds of thousands to several million dollars.

The group’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents. They then deploy ransomware and simultaneously list samples on their leak site to accelerate payment pressure. Extortion style combines encryption with public shaming, giving victims short deadlines before releasing data in batches.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used at Elis or pt.elis.com wherever it appears, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught and addressed in hours, not months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often chain back to the same addresses or parent credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy of your information yourself.

The speed with which ransomware groups like Devman move means ordinary families must act faster than the criminals. Starting with clear visibility into your exposed data gives you the advantage. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, hands-on remediation by specialists, and full household coverage that protects both adult accounts and children’s gaming profiles.