Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshotERPIS LLC (doing business as ShipERP), a Texas-based SAP integrator, reportedly had 705 MB of data taken across 5 files. The group states the stolen data includes source code, cryptographic keys, financials, contracts, credentials, installation media, and customer data. Sample filenames published include SAPSSL.pse, ERPIS.docx.html, SimpleAuthTokenStore.dat, Services.CSV, DEFAULT.PFL. The leak page lists ERPIS LLC as the victim (Texas-based) and shows the publication status as listed.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- SAP QuickBooks Intuit TSheets UPS Melio SFTP
What was taken
ERPIS LLC (doing business as ShipERP) — a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers. The exposed material includes: Complete product source code — all versions (2.0–5.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog); 128+ SAP cryptographic private keys (PSE files) — enabling JWT forgery, TLS impersonation, and SSO bypass across the entire SAP landscape; Live QuickBooks financial database (705 MB) — complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger; Full customer contract register — exact pricing for all 88 enterprise customers with $20.6M in deferred revenue; Production API credentials — 7 Intuit keys, UPS JWT tokens, TSheets OAuth, Melio payment API, SFTP credentials; SAP installation media (245 GB) — full HANA, S/4HANA, and kernel distributions; Customer SAP integration configurations (13 GB) — Boeing, IDT, EGLO, KTM, and dozens more software 58279 (/blog/erpis-llc-bb485230)
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- label
- backlog
- value
- $20.6M backlog
- backlog
- $20.6M backlog
- customers_named
- Boeing, Pfizer, NVIDIA, John Deere, Medtronic
- deferred_revenue
- $20.6M in deferred revenue
- doing business as
- ShipERP
- customer base note
- used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers
- enterprise_customers
- 88 enterprise customers
Leak-site images (2)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.