Skip to content
Emperador Ransomware Targets OnTrac with Employee Data Theft Claims

Emperador Ransomware Targets OnTrac with Employee Data Theft Claims

First seen 25 Sep 2026, 18:21 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 25, 2026 at 18:52 UTC
  • •Emperador ransomware claims to have stolen 197,000 employee records from OnTrac.
  • •OnTrac's previous breach in March 2026 involved unauthorized access to customer files.
  • •No independent verification of the current claims has been established.

The Emperador ransomware group has claimed a new attack against OnTrac, a major U.S. parcel carrier, alleging the theft of approximately 197,000 employee records and demanding a ransom of $1 million. This claim follows a previously confirmed network breach at OnTrac that occurred between March 20-22, 2026, where unauthorized access to customer files was reported. OnTrac has not publicly confirmed the latest ransomware claim, and there is currently no independent evidence to verify the extent of the alleged data compromise. The Emperador group has also threatened to release salary information for OnTrac employees. As of now, the claims remain unverified, and the situation is being monitored closely for any further developments or evidence from Emperador. The attack highlights ongoing vulnerabilities in the logistics sector and the potential for significant data breaches.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-20
OnTrac network breach confirmed
Unauthorized access to customer files was reported, affecting multiple records.
Dark Web Intelligence on X
2026-09-23
Emperador claims new attack on OnTrac
Emperador lists OnTrac, alleging theft of employee data and demanding a ransom.
Dark Web Intelligence on X
2026-09-25
Emperador threatens data release
Emperador announces plans to release employee salary information if demands are not met.
Ransomware.Live

More articles in this cluster (2)

Following this threat?

Track Emperador and Electrolux in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed