emperador

Emperador is a ransomware group that operates a data-theft–driven extortion model, publicly alleging stolen data and demanding payment; in September 2026 it claimed an attack against OnTrac, a major U.S. parcel carrier, alleging the theft of approximately 197,000 employee records and a ransom of $1 million, following a network breach described as occurring between March 20–22, 2026. Victims span multiple critical sectors, with Government & Defense, Manufacturing, Transportation, Education, and Energy & Utilities among the most affected, and the affected countries including Brazil, the United States, Italy, Albania, and India. A pattern in the reporting is that Emperador ties data theft to ransom demands after breaches, as illustrated by the OnTrac incident. ThreatCluster has recorded 28 victims claimed by Emperador.

Sectors: Manufacturing, government, Education · Countries: BR, US, DE