OptiProERP is a leading global provider of industry-specific ERP solutions for manufacture Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 25, 2022, OptiProERP, a provider of industry-specific ERP solutions for manufacturing, appeared on the leak site operated by the revil ransomware group. The group claims to have stolen internal data from the company in a ransomware attack. Public detail remains limited: the number of people affected is unknown, and no fuller accounting of the incident has been widely confirmed beyond the listing itself.

For customers, partners, and employees connected to an ERP provider, any claim of internal-file theft raises practical questions about what may have left the organisation’s systems and how that information could be misused. What follows summarises only what has been reported and places it in clear context.

Inside the incident

According to the available record, OptiProERP was listed by the revil ransomware group on or around July 25, 2022. The group stated that it had exfiltrated internal files during a ransomware attack. No public confirmation has detailed the precise date the intrusion began, how access was obtained, the volume of data taken, or whether a ransom demand was paid or refused. The number of individuals whose information may have been involved is listed as unknown. In short, the core public fact is the leak-site listing and the group’s claim of stolen internal data; further operational specifics have not been disclosed.

The group behind it: revil

REvil, also known as Sodinokibi, was a prominent ransomware operation that functioned largely as a ransomware-as-a-service model. Affiliates conducted intrusions and deployed the encryptor, while the core group handled negotiations, payment infrastructure, and the leak site used for double-extortion pressure. The typical pattern involved initial access (often through compromised credentials, vulnerable remote services, or supply-chain vectors), lateral movement, data theft, and then encryption, followed by threats to publish stolen material if payment was not made.

The group was linked to numerous high-profile incidents in the years before and around 2021–2022, including attacks that disrupted major organisations and supply chains. Law-enforcement actions eventually disrupted parts of the operation, yet listings and claims associated with the name continued to surface for a period afterward. In this case, the appearance of OptiProERP on the revil leak site constitutes the group’s claim; it should be treated as an unverified assertion unless independently confirmed by the victim or investigators.

About OptiProERP

OptiProERP is described as a leading global provider of industry-specific ERP solutions aimed at manufacturing organisations. ERP platforms of this type typically integrate finance, inventory, production planning, supply-chain, customer, and human-resources functions into a single system of record. Companies that supply such software often hold not only their own corporate data but also configuration details, support records, and sometimes operational information belonging to the manufacturers that rely on the product.

A breach involving an ERP vendor is consequential because the software sits at the centre of day-to-day business processes for its customers. Even when the primary target is the vendor’s own environment, the sensitivity of internal files—source materials, customer correspondence, technical documentation, or credentials—can create secondary risk for the manufacturers and partners connected to the platform.

What was likely exposed

The reported facts state that internal files were exfiltrated in a ransomware attack. No itemised inventory of those files has been made public, nor have specific categories such as customer databases, employee records, or financial documents been confirmed. Organisations of this kind commonly maintain source code or configuration assets, internal communications, customer and partner contact information, support tickets, contracts, and administrative credentials. Whether any of those categories were among the stolen material remains unconfirmed. Readers should treat the exact contents as undisclosed.

What's at stake

For individuals whose details may have been present in internal files, the practical risks include targeted phishing, social-engineering attempts that reference genuine business relationships, and potential misuse of any personal or contact data that happened to be stored. For manufacturing customers of an ERP provider, exposure of support or configuration information could, in theory, aid further reconnaissance against their own environments, though no such follow-on activity is established by the public record of this incident.

For OptiProERP itself, the stakes include operational disruption, reputational harm, possible regulatory or contractual obligations, and the cost of investigation and remediation. Because the scale of the theft and the precise data types remain unknown, the full extent of impact on either the company or third parties cannot be stated with certainty.

If your data was in this claimed breach

If you have a past or present relationship with OptiProERP—as an employee, customer, partner, or supplier—treat the incident as a prompt to review your exposure rather than as proof that your information was taken. Change passwords on any related accounts, enable multi-factor authentication where available, and watch for unsolicited messages that attempt to leverage knowledge of your business dealings. Monitor financial and account statements for unusual activity. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets, which provides one additional data point for deciding what further steps to take.

AICompiled with AI assistance from public sources and published under our editorial standards.