OnTrac claims of data breach by Emperador ransomware group

• Ransomware group: Emperador
• Country: United States
• Sector: Transportation
• Announcement date: September 23, 2026

Emperador claims compromise of OnTrac employee data

The threat actor known as Emperador has claimed to have compromised the personal data of 197,000 employees belonging to OnTrac. This announcement, made on September 23, 2026, indicates a significant targeted attack against the logistics provider. The claim involves a substantial volume of sensitive information, and the group has initiated a high-pressure extortion attempt against the organization.

Details of the alleged attack

According to the announcement posted on the group's leak site, the Emperador group targeted OnTrac on September 23, 2026. The threat actor has issued a ransom demand of 1 million dollars. The group has stated that if this payment is not met, the stolen data will be released to the public. Beyond the financial demand, the group has also issued direct threats toward the company's employees and business partners, utilizing pressure tactics to compel the organization to comply with their demands.

Data involved in the claim

The alleged leaked data consists of approximately 44.4 MB of information, which the group claims contains 197,000 records. These records reportedly contain Personally Identifiable Information (PII) belonging to the company's workforce. The specific types of data mentioned in the claim include:

• Employee personal data
• Contact information
• Employment records

The group further specifies that the information includes names, contact details, hire dates, social media profiles, and corporate identification numbers. Such a collection of data provides a comprehensive view of individual identities within the organization.

About OnTrac

OnTrac is a U.S.-based last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. The company operates as an alternative to FedEx and UPS, providing nationwide logistics services 7 days a week. As a major player in the transportation and logistics sector, the company manages a vast network of operations to facilitate e-commerce deliveries across the United States.

Analysis and potential implications

This breach may pose secondary risks to the affected employees, such as identity theft and targeted phishing attacks. Because the stolen information includes contact details and social media profiles, individuals may be more susceptible to highly personalized social engineering attempts. Furthermore, as a US-based entity, this incident could trigger legal proceedings under state-level data privacy laws and regulatory requirements.

Information about the Emperador group is limited; however, it appears that the group employs double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method is designed to maximize pressure on the victim by threatening reputational damage and regulatory scrutiny.

The exposure of this data could lead to significant reputational damage and a loss of trust with business partners. Additionally, the group's decision to target employees directly suggests an attempt to exert maximum psychological pressure on the company. Long-term negative impacts on the company's operational continuity and employee safety may occur as a result of this incident. In the logistics sector, maintaining the integrity of employee and partner data is critical for operational stability and trust.