Emperador ransomware group claims attack on Swiss multinational Holcim
The Emperador ransomware group claimed an attack on Switzerland-based industrial group Holcim on 31 October 2026, and threat intelligence firm SOCRadar reported the incident the following day. The case shows that this group, active since August, is now targeting large multinationals.
What happened
On 31 October 2026, the Emperador group added Holcim, a Switzerland-based multinational in the industrial sector, to the list of victims on its leak site. On 1 November, threat intelligence firm SOCRadar published a report on the ransomware attack against the company, backing the claim with an external source.
The available information does not specify what data may have been stolen, how much, or the operational impact of the incident, and it includes no statement from the company. It is therefore wise to wait for official information before drawing conclusions about the impact.
Who the group is
Emperador is a double-extortion ransomware group that emerged in August 2026; its first leak site post dates from 10 August. It steals data before encrypting systems and threatens to publish it, typically giving victims around two weeks.
According to leak site claims recorded by Orbitaley, its victims are spread across many countries, including the United States, Brazil, Colombia, the Philippines, Italy and Albania, and across sectors such as public administration, transport and logistics, manufacturing, education, and food and beverages. In late October it claimed to have stolen 3.9 GB of data from a multinational brewer, which the company has not publicly confirmed.
No technical analyses of its encryptor or entry methods have been published. However, claim trackers note that many of its victims had credentials exposed by infostealers, malware that harvests information from infected devices.
What organisations can do
As the main clue about its initial access points to stolen credentials, the most useful measures focus on identity management and on limiting the damage of any intrusion.
- Enforce MFA (multi-factor authentication) on VPNs, remote access, email and cloud services.
- Monitor for corporate credentials appearing in infostealer leaks and reset affected passwords immediately.
- Strengthen endpoint protection, including personal devices used for remote work, where infostealers often operate.
- Keep backups isolated from the network and test restoration regularly.
- Detect unusual outbound data transfers, a key defence against double extortion.
- Prepare an incident response plan that covers communication with customers and authorities.
Sources
About the group: Emperador
Get the alerts
Relevant vulnerabilities, notable ransomware victims, new groups and the weekly bulletin, as soon as they are published.
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.