**.at Listed by Devman Ransomware Group

On January 25, 2026, the Austrian domain registry .at appeared on the leak site of the devman ransomware group, which claims to have stolen and exfiltrated internal files during a ransomware attack.

What Public Reporting Shows

Public reporting indicates that .at was listed on the devman ransomware leak site on that date. The group states it obtained internal data as part of a ransomware incident. The exact number of people affected remains unknown, and the specific files taken have not been publicly detailed beyond the description of internal documents. No independent verification of the data volume or contents has been released by the registry or third parties at the time of writing.

Why This Matters for You and Your Family

When a national domain registry like .at loses control of internal files, the ripple effects reach ordinary people. Registration records, administrative contacts, billing information, and technical logs can contain personal details that tie real identities to domain ownership. If your family has ever registered a .at domain, hosted email there, or used related services, your information may now sit in an attacker’s archive. Even if you never interacted directly with .at, shared infrastructure and partner systems mean credentials or contact data can travel further than expected. Credential leaks like this one frequently cascade into account takeovers on unrelated services where the same email and password were reused.

The Doxxing and Identity-Chain Risks

Stolen internal files often contain more than names and addresses. They can include email addresses, phone numbers, account handles, and references to other systems. Attackers and subsequent buyers stitch these fragments together into identity chains that link your online activity to your real-world identity. A single exposed email can lead to discovery of your children’s gaming usernames, family photos, or home address. Once mapped, this information fuels harassment, targeted phishing, or identity theft. Gaming accounts are especially vulnerable because they frequently share credentials with email or domain services and are rarely protected with separate, strong authentication.

Devman Group’s Known Track Record

Public reporting attributes the attack to the devman ransomware group. The group emerged in recent years and has targeted organizations across multiple countries by deploying ransomware, exfiltrating data, and then publishing samples on its leak site when victims do not pay. Its typical playbook involves initial access through common vulnerabilities or stolen credentials, followed by data theft and extortion demands with a public countdown. Past victims have included companies in various sectors, though specific prior incidents remain limited in open sources. Readers can follow independent ransomware trackers for updates on devman’s activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup of exposed records.
• Rotate any password you used on .at or related Austrian registry services anywhere else it appears, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you is caught in hours rather than months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often chain back to the same credentials and addresses.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

The incident shows that even organizations tasked with maintaining critical internet infrastructure can fall victim to ransomware operators who move quickly from breach to public shaming. Protecting yourself means treating every exposed dataset as a potential link in a larger chain that can reach your family. Start your DoxxScan trial today for continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. DoxxScan by GalaxyWarden is also effective for protecting gaming accounts because credential leaks like this one cascade into account takeovers and doxxing chains.