Dark Web Intelligence on X: " HOLCIM LISTED BY "EMPERADOR" RANSOMWARE ...

X • October 31, 2026

Dark Web Intelligence @DailyDarkWeb 🇨🇭 🚨 HOLCIM LISTED BY "EMPERADOR" RANSOMWARE GROUP The Emperador ransomware group has added Holcim, the Switzerland-based global building-materials company behind brands such as Lafarge, Aggregate Industries and Firestone Building Products, to its leak site. The listing describes Holcim as a building-materials and building-solutions company founded in Switzerland in 1912. The listing excerpt does not say how much data the group claims to have taken. The claim has not been independently verified, and Holcim has not publicly confirmed a cyber incident. ⚠️ Analyst Note: Emperador is a fairly new double-extortion group, active since August 2026, that has recently listed other large brands, including AB InBev. Its listings often come before any data is released, so the scope here is unknown. Holcim's suppliers, distributors and staff should watch for Holcim-themed phishing and invoice fraud. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #Emperador #Holcim #DataLeak #ThreatIntelligence #CyberSecurity 10:12 AM · Oct 31, 2026 · 4,204 Views 3

Security Brief @secbrief 6h Cement plants run kilns that you cant just switch off and reboot. Curious if this hit IT only or the plant side too. A leak site listing usually means they didnt pay, or at least not yet.

Ondrej Simaichl @ondrejsimaichl1 8h small detail, firestone building products is now called elevate and went to amrize when holcim spun off north america in 2025. makes me wonder how old that data is 1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Emperador Ransomware Targets AB InBev, Demands $1M Ransom The Emperador ransomware group has claimed responsibility for a cyber incident involving AB InBev, the world's largest brewer. They have reportedly added the company to their leak site, claiming to possess 3.9 GB of data, including 2,510 corporate emails and 19,000 access logs. The group is demanding a ransom of $1 million in Bitcoin, with a deadline set for November 23. The authenticity of the data has not been independently verified, and AB InBev has not confirmed any breach. The data appears to focus on marketing and cloud storage rather than brewing operations. If the internal PKI certificates are valid, they would require revocation and rotation to mitigate potential risks. Partners and employees are advised to be vigilant for AB InBev-themed phishing attempts. 10 sources 40

Extracted Entities

Dark Web Intelligence on X: " HOLCIM LISTED BY "EMPERADOR" RANSOMWARE ...

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Countries (1)

MITRE ATT&CK (1)

Ransomware Groups (1)