Emperador 2026 activity
Extortion group. 4 reports in 4 countries: 0 confirmed, 4 claimed or disputed. Latest 23 Sep 2026.
Brazil · 
Sweden · 
Vietnam · 
Philippines
🎯 What sources say
- Philippines: New group that claimed 2.9 GB from the City Government of Baguio in August. Ransomware.live
- Vietnam: Claimed EVN Hanoi customer data and offered it for sale in August 2026. ransomware.live
🚨 Reports
| Organisation | Country | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|---|
 ⚠️ ClaimedReceita Federal do Brasil | Brazil | 23 Sep 2026 | Government | Ransomware | Emperador | Claimed. The Emperador group listed the federal tax authority on its leak site. | ransomware.live✓ 7 Nov |
 ⚠️ ClaimedElectrolux | Sweden | 19 Sep 2026 | Manufacturing | Data leak | Emperador | Claimed. Emperador said it exported about 41 GB from an Electrolux Azure database and threatened to leak it. No company statement found. | DeXpose✓ 8 Nov |
 ⚠️ ClaimedEVN Hanoi Power Corporation (EVNHANOI) | Vietnam | 22 Aug 2026 | Energy | Data leak | Emperador | Claimed. Emperador claimed over 300 GB including about 13.36 million customer records, 6.99 million subscriptions and 2.26 million account records, offered for sale. | ransomware.live · cyberthreatintelligence.net✓ 7 Nov |
 ⚠️ ClaimedCity Government of Baguio (BUILDPass) | Philippines | 12 Aug 2026 | Government | Ransomware | Emperador | Claimed. Emperador listed the city on 12 August claiming 2.9 GB of permits, IDs and blueprints; the city disabled its BUILDPass permit system. | Ransomware.live · BlackFog✓ 7 Nov |
Leak-site listings are claims until the organisation or authorities confirm them. Methodology