EMPERADOR
Data as of October 1, 2026.
Credential exposure before the attack
20.7% of EMPERADOR victims whose domain we can identify (6 of 29) had employee credentials leak in the 12 months before EMPERADOR named them as a victim.
We don't know whether any of these credentials were how EMPERADOR gained initial access.
What industries EMPERADOR targets
Sector identified for 24 of 29 victims.
| Manufacturing | 6 | |
| Government | 4 | |
| Education | 4 | |
| Energy | 2 | |
| Automotive | 2 | |
| Technology | 2 | |
| Retail | 1 | |
| Financial Services | 1 |
Where the victims are located
Country identified for 27 of 29 victims.
| United States | 7 | |
| Brazil | 5 | |
| Colombia | 3 | |
| Philippines | 2 | |
| India | 2 | |
| Italy | 2 | |
| Vietnam | 1 | |
| Spain | 1 |
Most recent EMPERADOR victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Polikem polikem.com.co | Manufacturing | Colombia | Sep 30, 2026 |
| Amazon Informatica amazoninformatica.com.br | Technology | Brazil | Sep 29, 2026 |
| SitePro Rentals siteprorentals.com | Manufacturing | United States | Sep 29, 2026 |
| CSA Car Service Abschlepp- und Bergungsdienst csa-abschleppdienst-berlin.de | Not identified | Germany | Sep 28, 2026 |
| OnTrac ontrac.com | Logistics | United States | Sep 24, 2026 |
| Receita Federal do Brasil receitafederal.gov.br | Government | Brazil | Sep 24, 2026 |
| Alabama Women\'s Health Care alabamawomenshealth.com | Healthcare | United States | Sep 21, 2026 |
| Prefeitura Municipal de Cássia-MG mg.gov.br | Education | Brazil | Sep 21, 2026 |
| Studio Notarile Associato Salvatore Costantino e Anna Favarato costantinofavarato.it | Not identified | Italy | Sep 21, 2026 |
| Electrolux Group electrolux.com | Manufacturing | Sweden | Sep 21, 2026 |
| Westbridge Institute of Technology westbridge.edu.ph | Education | Philippines | Sep 18, 2026 |
| Sevenoaks 7oaks.cz | Manufacturing | Czech Republic | Sep 17, 2026 |
| RDA Motors rda-stellantis.it | Automotive | Italy | Sep 17, 2026 |
| Navitrans navitrans.com.co | Manufacturing | Colombia | Sep 14, 2026 |
| Nexbex Solutions nexbex.in | Technology | India | Sep 14, 2026 |
| EJ Easy Job easyjobsas.com | Financial Services | Colombia | Sep 11, 2026 |
| BHMAC bhmac.org | Government | Not identified | Sep 10, 2026 |
| Universal Starch-Chem Allied universalstarch.com | Manufacturing | India | Sep 10, 2026 |
| Poder Judicial de la Provincia de Jujuy justiciajujuy.gov.ar | Not identified | Argentina | Sep 7, 2026 |
| Hanwha Renewables hanwharenewables.com | Energy | United States | Aug 31, 2026 |
Showing the 20 most recent of 29. Browse recent data breaches for more.
EMPERADOR leak site
The address we've seen EMPERADOR publish victims from. Any .onion address needs the Tor Browser.
emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion
EMPERADOR questions
Is EMPERADOR still active?
Yes. EMPERADOR posted its most recent victim on September 30, 2026. That's 19 victims in the last 30 days.
How many victims has EMPERADOR claimed?
EMPERADOR has named 29 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files.
When did EMPERADOR first appear?
The first victim we recorded for EMPERADOR was posted on August 12, 2026. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does EMPERADOR target?
Manufacturing accounts for the most victims we can classify, with 6. Government follows at 4. We could identify a sector for 24 of 29 victims, so treat this as the shape of the targeting rather than a full census.
Has EMPERADOR already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.