Skip to content
Leak-site post naming AB InBev, captured by ThreatCluster

AB InBev

emperador

Ransomware leak-site victim intelligence · EN

Data size
3.9 GB
Views
4,414
Posted
Oct 25, 2026
Country
Belgium
Industry
brewing and beverages

Summary

Written by ThreatClusterfrom leak post, our reporting

Emperador claims AB InBev was breached and that 3.9 GB of its data—including 2,510 corporate emails and 19,000 access logs—has been exfiltrated and posted on the group’s leak site. The leak page lists the publication status as “listed.” The group claims a ransom demand of $10,000,000 in BTC, while a contemporaneous news report states a $1,000,000 ransom.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

We hold 329,244 AB InBev social-listening alerts, 2,510 corporate emails across all subsidiaries, 19K access logs, GBS portal records, internal PKI certificates, and 3.2GB of Azure blob assets.

Data categories
social-listening alertscorporate emailsaccess logsGBS portal recordsPKI certificatesAzure blob assets
File types seen
txt × 2
Sample files (2)
employees.txt
gbs.txt

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Gallery
Proof Image
To Publish
abinbev.7z

Leak-site images (3)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a stylized red logo with angular shapes resembling a hooded figure or mask.
onion leak page1.2 MB
Screenshot of a database or application interface displaying access requests with user details, including IDs, types, management, and approval statuses.
onion leak page142 KB