15.4% of EMPERADOR victims whose domain we can identify (6 of 39) had employee credentials leak in the 12 months before EMPERADOR named them as a victim.
We don't know whether any of these credentials were how EMPERADOR gained initial access.
What industries EMPERADOR targets
Sector identified for 33 of 39 victims.
Where the victims are located
Country identified for 35 of 39 victims.
Most recent EMPERADOR victims
Showing the 20 most recent of 39. Browse recent data breaches for more.
The address we've seen EMPERADOR publish victims from. Any .onion address needs the Tor Browser.
emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion
Is EMPERADOR still active?
Yes. EMPERADOR posted its most recent victim on October 21, 2026. That's 16 victims in the last 30 days.
How many victims has EMPERADOR claimed?
EMPERADOR has named 39 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did EMPERADOR first appear?
The first victim we recorded for EMPERADOR was posted on August 12, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does EMPERADOR target?
Manufacturing accounts for the most victims we can classify, with 7. Government follows at 4. We could identify a sector for 33 of 39 victims, so treat this as the shape of the targeting rather than a full census.
Has EMPERADOR already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
