Devman
Data as of August 16, 2026.
Credential exposure before the attack
22.9% of Devman victims whose domain we can identify (25 of 109) had employee credentials leak in the 12 months before Devman named them as a victim.
We don't know whether any of these credentials were how Devman gained initial access.
What industries Devman targets
Sector identified for 83 of 109 victims.
| Manufacturing | 16 | |
| Healthcare | 15 | |
| Government | 8 | |
| Construction | 7 | |
| Education | 6 | |
| Logistics | 6 | |
| Technology | 4 | |
| Retail | 3 |
Where the victims are located
Country identified for 90 of 109 victims.
| United States | 29 | |
| Thailand | 7 | |
| Canada | 5 | |
| Spain | 5 | |
| France | 4 | |
| Brazil | 4 | |
| United Kingdom | 4 | |
| South Africa | 4 |
Most recent Devman victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Crystal Coast Pain Management Center crystalcoastpm.com | Real Estate | United States | Feb 4, 2026 |
| Encompass Solutions encompass-inc.com | Not identified | United States | Feb 3, 2026 |
| WJNK Law wjnklaw.com | Legal | United States | Feb 2, 2026 |
| Woodward Oral Surgery woodwardoralsurgery.com | Healthcare | United States | Feb 2, 2026 |
| Aegis Project Controls consultaegis.com | Construction | United States | Jan 29, 2026 |
| TIW Group tiw-group.com | Construction | United States | Jan 29, 2026 |
| Zelenkofske Axelrod zallc.org | Financial Services | United States | Jan 29, 2026 |
| TWI Group twi-group.com | Logistics | United States | Jan 28, 2026 |
| CS Caritas Socialis cs.at | Not identified | Austria | Jan 27, 2026 |
| AutoMax automax.com | Automotive | United States | Jan 22, 2026 |
| MIMS mims.com | Healthcare | United Kingdom | Jan 22, 2026 |
| Saunders and Saunders saundersandsaunders.com | Legal | Not identified | Jan 22, 2026 |
| Bangkok CCTV bangkok-cctv.com | Not identified | Thailand | Jan 21, 2026 |
| Feel Four feelfour.com | Retail | Spain | Jan 21, 2026 |
| National Shooting Sports Foundation nssf.org | Education | United States | Jan 21, 2026 |
| Consigaz consigaz.com.br | Manufacturing | Brazil | Jan 13, 2026 |
| KLH Industries klhindustries.com | Manufacturing | United States | Jan 13, 2026 |
| Pronaca pronaca.com | Agriculture | Not identified | Jan 13, 2026 |
| City of Seal Beach sealbeachca.gov | Government | United States | Jan 13, 2026 |
| Seal Beach Police Department sealbeachpd.com | Not identified | United States | Jan 13, 2026 |
Showing the 20 most recent of 109. Browse recent data breaches for more.
Devman leak sites
Addresses we've seen Devman publish victims from. Any .onion address needs the Tor Browser.
devmanblggk7ddrtqj3tsocnayow3bwnozab2s4yhv4shpv6ueitjzid.onionqljmlmp4psnn3wqskkf3alqquatymo6hntficb4rhq5n76kuogcv7zyd.onionwugurgyscp5rxpihef5vl6b6m5ont3b6sezhl7boboso2enib2k3q6qd.onionmbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
Devman questions
Is Devman still active?
It's gone quiet. The last victim we recorded was February 4, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.
How many victims has Devman claimed?
Devman has named 109 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 81 of them were posted in the last 12 months.
When did Devman first appear?
The first victim we recorded for Devman was posted on April 7, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Devman target?
Manufacturing accounts for the most victims we can classify, with 16. Healthcare follows at 15. We could identify a sector for 83 of 109 victims, so treat this as the shape of the targeting rather than a full census.
Has Devman already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.