EMPERADOR
Data as of September 14, 2026.
What industries EMPERADOR targets
Sector identified for 13 of 16 victims.
| Government | 3 | |
| Manufacturing | 2 | |
| Education | 2 | |
| Energy | 2 | |
| Financial Services | 1 | |
| Retail | 1 | |
| Automotive | 1 | |
| Technology | 1 |
Where the victims are located
Country identified for 14 of 16 victims.
| United States | 4 | |
| India | 2 | |
| Colombia | 2 | |
| Brazil | 2 | |
| Argentina | 1 | |
| Philippines | 1 | |
| Vietnam | 1 | |
| Spain | 1 |
Every EMPERADOR victim
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Navitrans navitrans.com.co | Manufacturing | Colombia | Sep 14, 2026 |
| Nexbex Solutions nexbex.in | Technology | India | Sep 14, 2026 |
| EJ Easy Job easyjobsas.com | Financial Services | Colombia | Sep 11, 2026 |
| BHMAC bhmac.org | Government | Not identified | Sep 10, 2026 |
| Universal Starch-Chem Allied universalstarch.com | Manufacturing | India | Sep 10, 2026 |
| Poder Judicial de la Provincia de Jujuy justiciajujuy.gov.ar | Not identified | Argentina | Sep 7, 2026 |
| Hanwha Renewables hanwharenewables.com | Energy | United States | Aug 31, 2026 |
| Faculdade Uniguacu uniguacu.com.br | Education | Brazil | Aug 31, 2026 |
| Capitol Mechanics mycarservice.com | Automotive | United States | Aug 28, 2026 |
| Reveal Data revealdata.com | Government | United States | Aug 28, 2026 |
| EVNHANOI evnhanoi.vn | Energy | Vietnam | Aug 24, 2026 |
| Frucastro frucastro.es | Retail | Spain | Aug 24, 2026 |
| NetExam netexam.com | Not identified | United States | Aug 21, 2026 |
| Prefeitura Municipal de Arcos mg.gov.br | Education | Brazil | Aug 19, 2026 |
| Training 4 All rash.al | Not identified | Not identified | Aug 19, 2026 |
| City of Baguio baguio.gov.ph | Government | Philippines | Aug 12, 2026 |
Browse recent data breaches for more.
EMPERADOR leak site
The address we've seen EMPERADOR publish victims from. Any .onion address needs the Tor Browser.
emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion
EMPERADOR questions
Is EMPERADOR still active?
Yes. EMPERADOR posted its most recent victim on September 14, 2026. That's 15 victims in the last 30 days.
How many victims has EMPERADOR claimed?
EMPERADOR has named 16 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did EMPERADOR first appear?
The first victim we recorded for EMPERADOR was posted on August 12, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does EMPERADOR target?
Government accounts for the most victims we can classify, with 3. Manufacturing follows at 2. We could identify a sector for 13 of 16 victims, so treat this as the shape of the targeting rather than a full census.
Has EMPERADOR already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.