Desysweb listed on nova ransomware leak site

• Ransomware group: nova
• Country: Peru
• Sector: Technology
• Announcement date: May 8, 2026

Technology solutions integrator Desysweb targeted by nova ransomware group

Desysweb, a technology solutions integrator, has been listed on the leak site of the ransomware group known as nova. The announcement, which appeared on May 8, 2026, follows a claimed attack date of May 7, 2026. The group has publicly claimed responsibility for the incident, asserting that they have successfully compromised the organization's digital infrastructure.

Claims of system encryption and data loss

According to the claims made by the nova group, the systems belonging to Desysweb have been encrypted. The threat actors state that the attack has affected a significant volume of information, specifically claiming that over 60,000 files are involved in the incident. The group has issued a warning to the organization, stating that the affected data may become irrecoverable after a certain countdown period expires.

To resolve the situation, the group has urged the organization to follow specific recovery instructions that have been placed within the encrypted systems. This method of communication is a common tactic used by ransomware groups to maintain contact with their targets during an ongoing extortion attempt. While the group has made these claims, there is currently no detailed information regarding the specific nature of the leaked or encrypted data, and the provided screenshots do not verify the actual content of the breach.

Organization profile

Desysweb is a technology solutions integrator that specializes in telecommunications and IT services. Their service portfolio includes managed services and the operation of a Security Operation Center (SOC). The company possesses over 13 years of experience in the industry and maintains operations across eight provinces within Peru. Notably, the organization holds the ISO 27001:2022 certification, reflecting its commitment to information security management standards.

Impact assessment and industry implications

The encryption of an organization's systems can lead to significant disruptions in operational continuity. For a technology services provider like Desysweb, such an event may pose indirect risks to its client base, which consists of more than 200 clients. Because the entity is based in Peru, the incident may trigger legal processes under relevant local data protection regulations.

Potential risks and extortion methods

The potential exposure or permanent loss of data could result in both reputational and commercial damage to the organization, despite its existing ISO 27001 certification. The threat actor's approach suggests the potential employment of the double extortion method. In such scenarios, attackers not only encrypt data to disrupt operations but also threaten to leak sensitive information to exert maximum pressure on the victim to pay the ransom.

Defensive considerations for technology providers

While public information regarding the nova group remains limited, this incident highlights the ongoing risks faced by technology integrators. Organizations in this sector often manage critical infrastructure for multiple clients, making them high-value targets. Common defensive strategies for such entities typically include maintaining robust, offline backups, implementing strict access controls, and continuous monitoring through a Security Operation Center to detect unauthorized activity before encryption occurs. The complexity of managing diverse IT and telecommunications services means that a single breach can have a cascading effect on the supply chain of many downstream clients.