SJERP Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target enterprise software providers and the organisations that rely on them, using data theft as leverage alongside encryption. Listings on criminal leak sites have become a routine pressure tactic, even when independent confirmation of the intrusion remains limited. Against that backdrop, the appearance of SJERP on a ransomware group's site in late April 2025 fits a familiar pattern of claims that demand careful scrutiny rather than immediate acceptance.

Public reporting indicates that SJERP, associated with the ERP platform at sj.com.do, was listed by the nova ransomware group on 29 April 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. The number of people affected is unknown, and many operational details have not been disclosed. The claim matters because ERP systems sit at the centre of business operations and often hold sensitive commercial and personal information; any confirmed compromise could affect customers, partners and employees who depend on the software.

What happened

According to available public information, SJERP was listed by the nova ransomware group on 29 April 2025. The group claims that internal files were exfiltrated as part of a ransomware attack. No independent confirmation of the intrusion, the precise method of access, the volume of data taken, or the timeline of events has been provided in the reported facts. The number of individuals potentially affected remains unknown. Public detail is limited to the leak-site listing itself and the characterisation of the material as internal files.

Who is nova?

Nova is a ransomware operation that has appeared in public threat reporting as a group that combines encryption of victim systems with the theft of data for double-extortion purposes. Like many contemporary ransomware actors, it typically maintains a leak site on which it lists organisations it claims to have compromised, sometimes publishing samples or full archives if ransom demands are not met. The group’s tactics generally follow the pattern of initial access through common vectors such as phishing, exposed remote services or compromised credentials, followed by lateral movement, data staging and exfiltration before ransomware deployment. Its listings are claims made by the actors themselves and should be treated as unverified until corroborated by the victim organisation, law enforcement or independent forensic reporting. In this case, the facts state only that SJERP was listed; no further statements attributed specifically to nova about this victim are available beyond the assertion of internal-file exfiltration.

Who is SJERP?

SJERP is associated with the website sj.com.do, described as the official platform for SJ ERP, a comprehensive Enterprise Resource Planning software developed by JoS. ERP systems of this type are designed to integrate core business processes—finance, inventory, human resources, supply chain and customer management—into a single platform used by organisations across sectors. Providers and operators of such software typically hold configuration data, customer records, operational documents and, in many cases, personally identifiable information belonging to employees or end users of client companies. A breach involving an ERP platform can therefore carry consequences not only for the software provider but also for the businesses that rely on it for daily operations. The exact corporate structure and customer base of SJERP beyond the public description of its ERP offering are not detailed in the available facts.

What data was at risk

The reported facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases or specific categories of personal or commercial data has been disclosed. Organisations that develop and operate ERP software commonly store source code or configuration materials, customer contracts, financial records, employee information and operational documentation. Whether any of those categories were among the files claimed by nova is unconfirmed. Because the number of people affected is listed as unknown and the precise contents remain undisclosed, it is not possible to state with certainty what personal or corporate data, if any, left the organisation’s control.

The real-world impact

If the claim of exfiltration is accurate, affected individuals and organisations face the ordinary risks associated with internal business files entering criminal hands: potential misuse of commercial information, targeted phishing that references genuine internal details, and secondary fraud attempts. For SJERP itself, a ransomware incident can disrupt service delivery, damage trust among customers who depend on the ERP platform, and create regulatory or contractual obligations to notify parties whose data may have been involved. Because the scale and exact data types remain unknown, the concrete impact on any given person or client cannot yet be quantified. Even unconfirmed listings can generate concern and operational cost as organisations investigate and prepare notifications.

If your data was in this claimed breach

If you are a customer, partner or employee of SJERP or of organisations that use its ERP software, treat the listing as a prompt for caution rather than confirmed exposure. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to phishing messages that appear to reference the company or its systems. Change passwords on any accounts that may have shared credentials with work systems. Keep records of any suspicious contact. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets, which can help prioritise further protective steps while official details remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.