SD Soluciones Digitales targeted by nova ransomware group

• Ransomware group: nova
• Country: Mexico
• Sector: Technology
• Announcement date: October 5, 2025

The ransomware group known as nova has claimed responsibility for a data breach involving SD Soluciones Digitales. According to an announcement made on the group's leak site, the attackers allege they have successfully compromised the systems of the Mexican technology company, resulting in the theft of a significant volume of data.

The details of the alleged attack

The incident was officially announced on October 5, 2025. The nova ransomware group claims that they gained unauthorized access to the internal systems of SD Soluciones Digitales. Following this access, the group alleges they were able to exfiltrate approximately 80 GB of data from the organization's infrastructure. The announcement, which was published on the group's dedicated leak site, characterizes the event as a data leak rather than a simple encryption event, which is a common tactic used in modern cyberattacks.

In many contemporary ransomware campaigns, threat actors employ a strategy known as double extortion. In this model, attackers do not merely encrypt a victim's files to demand a ransom for decryption; they also steal sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. While the specific ransom demand for this incident has not been disclosed, the listing of the company's data on a leak site confirms that the group is utilizing this pressure tactic.

The nature of the leaked information

The information allegedly stolen by the nova group is said to be highly relevant to the commercial operations of the victim. The group claims that the stolen data includes various documents that could be used to disrupt the company's business functions or damage its reputation. Based on the claims made by the attackers, the leaked content is alleged to consist of the following types of information:

• Invoices
• Billing documents
• Corporate reports

The presence of such documents suggests that the attackers have targeted the administrative and financial core of the organization. The specific details regarding the exact number of files stolen or the specific nature of the