Emperador ransomware group lists Electrolux & Ontrac on its leak site

• Ransomware group: Emperador
• Sector: Manufacturing
• Announcement date: September 25, 2026

Emperador claims data breach against Electrolux and Ontrac

The threat actor known as Emperador has published a leak announcement on a ransomware leak site, claiming to possess sensitive data belonging to two distinct entities: Electrolux and Ontrac. The announcement, posted on September 25, 2026, suggests a targeted operation aimed at these organizations. While the specific circumstances of the initial intrusion remain unconfirmed, the group has moved to a public stage to exert pressure on the victims.

According to the claims made by the threat group, they attempted to establish contact with the IT helpdesks of both Electrolux and Ontrac to initiate negotiations. However, the group stated that they did not receive any response from the organizations' technical support teams. Following this lack of communication, the attackers have issued a threat to release additional datasets within a one-week timeframe. This escalation is a hallmark of modern ransomware operations, where the threat of further exposure is used to force a response from the targeted entities.

Details of the claimed data theft

The announcement provided by Emperador specifies that the stolen information includes sensitive details regarding the workforce of the targeted companies. Based on the information provided in the leak record, the data allegedly includes:

• Employee information
• Employee salary data

The group has provided a screenshot as evidence of the breach, which references a dataset totaling 75.1 MB. The specific contents of the leak are described as containing employee salary information for Ontrac and general employee information for Electrolux. No information was provided regarding the specific file count or the exact ransom demand requested by the group.

Organizational profiles and supply chain connection

The two organizations listed in the leak record represent different sectors but are linked through their business operations. Electrolux is a global manufacturer of home appliances, a major player in the manufacturing sector. Ontrac is a logistics company that specializes in providing last-mile delivery services for various e-commerce retailers.

The inclusion of both companies in a single leak announcement is attributed to their supply chain relationship. In modern industrial environments, the interconnectedness of manufacturers and their logistics providers creates a complex web of data exchange, which can sometimes lead to vulnerabilities that affect multiple entities within the same supply chain.

Analysis of the threat and potential consequences

This incident highlights the growing trend of double extortion tactics, a method where ransomware groups not only encrypt an organization's data but also steal sensitive information to use as leverage. By threatening to leak private data, the attackers aim to maximize the pressure on the victim to pay a ransom, moving beyond simple operational disruption to direct reputational and legal threats.

The potential consequences of this exposure are significant. For the organizations involved, the leakage of personal employee data and salary records can lead to substantial reputational damage and serious legal consequences. From a regulatory standpoint, administrative fines may be imposed under the various data protection laws and regulations in the regions where these companies operate. Furthermore, the exposure of such specific information increases the risk of secondary attacks, such as identity theft or highly targeted phishing campaigns directed at the affected personnel.

Publicly available information regarding the Emperador group remains limited, and their specific methodologies and technical capabilities have not yet been fully analyzed by the security community. This incident serves as a reminder of the risks inherent in supply chain dependencies. Organizations in the manufacturing and logistics sectors can mitigate such risks by implementing robust data protection frameworks, ensuring rigorous third-party risk management, and maintaining high levels of communication readiness for incident response scenarios.