2026 Holcim — company confirms a cyberattack with limited data access; Emperador ransomware group claims about 360 GB (unverified)
Data compromised
Holcim has not said what kind of data was accessed or taken. The roughly 360 GB figure comes from the group's claim. A single social-media alert says the group intends to publish the data within 13 to 14 days of its listing; that timing has not been independently confirmed.
Technical writeup
Inside IT reports that Emperador has been active only since August 2026 and has carried out roughly 80 attacks, though trackers give different victim counts. Most coverage is German-language, and the full Inside IT article is paywalled. We have not found a Holcim press release.
Root cause
Holcim confirmed a cyberattack and described limited access to data, according to Inside IT (November 3, 2026). The company has not said how the attacker got in. The Emperador ransomware group listed Holcim on its leak site on October 31, 2026, and claims to have taken about 360 GB. Holcim has not confirmed that figure, and whether a ransom was demanded is not known. The incident date has not been disclosed; October 31 is the leak-site listing date.