Holcim
Zug, Switzerland2 sources
Claimed:Emperador claimed it on a ransomware leak site on 31 Oct 2026. Not confirmed by the organisation, so treat it as a claim, not a fact.
Emperador claims to have breached building materials giant Holcim
The Emperador ransomware group listed Holcim on its leak site on 31 October 2026. The entry provides no compromise date, no description of the alleged intrusion, and does not establish whether systems were encrypted or data exfiltrated.
- Type
- Ransomware
- Sector
- Manufacturing
- Claimed by
- Emperador
- First reported
- 31 Oct 2026
- Latest source
- 31 Oct 2026
What to do
- This is only a claim by the attackers so far. Do not panic, but do the basics:
- Expect delays if you rely on this organisation's services, and keep records of anything you are owed.
- If you have an account, change that password, and anywhere you reused it.
- Treat this as unverified. Ask the organisation directly before acting on it.
- If you connect to this organisation (VPN, file transfer, email), review and restrict those links until they confirm containment.
- Check that your own backups are offline or immutable and that you have tested a restore recently.
Not sure? Ask an assistant with the sources attached, or have a coding agent check your systems.
Check your systems for Holcim