Holcim, the Swiss building materials group, has confirmed that attackers got into its systems and stole data. The admission came days after the Emperador ransomware gang put the company on its leak site and threatened to publish what it says is about 360GB of files. Holcim calls the incident "limited". It says production, logistics and customer deliveries are running normally. It has not said what data was taken, which countries or business units are affected, or how the attackers got in. That leaves the company's UK business, along with the UK construction firms and suppliers that deal with it, without answers for now.
What Happened
On 31 October 2026, Emperador added Holcim to its leak site. Ransomware.live tracks public postings by ransomware gangs, and SECNEWS reports that it recorded the listing that morning with a claimed data volume of 364.2GB. On 1 November the threat intelligence firm SOCRadar published its own report on the claim, according to Orbitaley.
On 3 November, Holcim confirmed the incident to the Swiss trade publication Inside IT, which first reported the story. The company told Inside IT it had "detected limited, unauthorised access to data, as well as its theft." The Swiss news agency AWP ran the story next, and outlets including SwissCybersecurity.net, Die Presse and MarketScreener picked it up. AWP quoted Holcim describing an "unauthorised data leak of limited scope."
The company's account, as reported across these outlets:
- Industrial control systems, production sites and logistics networks were not affected.
- Business operations and customer deliveries are continuing without restriction.
- Its security team moved to contain the incident once it was detected, and a forensic investigation is under way.
- According to Cyberiack's account of the AWP report, part of the investigation is assessing what the affected files contain so the company can meet its obligations under privacy law.
Holcim has not said publicly whether it has received a ransom demand. No regulator filing or data protection authority notice has been published.
What Was Taken
The company and the attackers describe the theft very differently. Holcim calls it limited in scope. Emperador claims a large haul, and the reported size varies slightly by source: Inside IT and AWP give about 360GB, while Ransomware.live's index records 364.2GB, according to SECNEWS. Either way, the figure comes from the attackers and nobody has independently verified it. Ransomware gangs often inflate their claims to put pressure on victims, and the size of a data set says nothing about how sensitive it is.
Holcim has not said what kind of data was stolen: employee records, customer and supplier details, financial documents, contracts or technical material. It has also not said which subsidiaries or countries the data belongs to. That second gap matters for the UK. MarketScreener's company profile says the United Kingdom accounts for about 10.2% of Holcim's net sales, making it the group's second-largest market after France. SECNEWS warns that UK customers and suppliers may be exposed, but Holcim has not confirmed that any UK data is involved.
No data from the claimed haul has been reported as published yet. Orbitaley says Emperador usually gives victims about two weeks before it releases files.
Why It Matters
Holcim is one of the world's largest building materials companies, with headquarters in Zug. Reported headcounts differ: the Swiss IT firm ncloud.swiss cites more than 45,000 employees in 45 countries and 2025 revenue of CHF 15.7 billion, while MarketScreener's profile lists about 50,000 employees. Either way, the company is a supplier to construction projects across Europe, the Americas and Australia. A data theft at that scale can affect partners as well as the company itself. Supplier invoices, bank details, contract terms and contact lists are exactly what fraudsters need to run convincing payment-diversion and business email compromise scams against firms further down the supply chain.
The case also shows how quickly Emperador has grown. Inside IT reports the gang has only been active since August and has carried out about 80 attacks in that time. Orbitaley dates its first leak site post to 10 August 2026. It says the gang has claimed victims in the United States, Brazil, Colombia, the Philippines, Italy and Albania, in sectors including public administration, transport and logistics, manufacturing, education, and food and drink. ncloud.swiss says Emperador works with affiliates, which helps explain how fast it has grown. A group of this size can now hit a multinational with its own security teams. Organisations should not assume that being big, or having an in-house security team, keeps them out of reach.
The Attack Technique
How the attackers got into Holcim is not known. The company has not said, and no technical analysis of Emperador's encryption malware or entry methods has been published, according to Orbitaley.
What is known about the gang points one way. Orbitaley reports that leak site trackers have noticed many Emperador victims had credentials exposed by infostealers, malware that harvests saved passwords, session cookies and other login data from infected machines. That is a pattern across the gang's victims. Nobody has shown it is how Holcim was breached.
Emperador runs a double-extortion model. It steals data and threatens to publish it, and in many cases also encrypts the victim's systems. Holcim's statement says nothing about encryption, and its claim that operations were unaffected suggests this may have been a theft-only intrusion, or that any encryption was contained before it reached production systems. Accounts so far don't settle which.
What Organizations Should Do
- Hunt for infostealer exposure. Check threat intelligence feeds and breach monitoring for company credentials and session cookies taken from infected devices, including staff personal and contractor machines. Reset any exposed accounts and revoke their active sessions, not just their passwords.
- Enforce phishing-resistant MFA on all remote access. Prioritise VPN, remote desktop gateways, single sign-on portals and cloud admin consoles. Stolen passwords are much less useful when FIDO2 or certificate-based authentication is required.
- Watch for large outbound transfers. A theft of hundreds of gigabytes leaves traces. Alert on unusual egress volumes, uploads to file-sharing and cloud storage services, and archiving tools such as rclone, WinRAR or 7-Zip running on servers.
- Holcim customers and suppliers: lock down payment changes. Treat any request to change bank details, or any urgent invoice that appears to come from Holcim, as suspect until you have confirmed it by phone using a number you already hold. Warn finance and procurement staff that stolen correspondence could make phishing emails look authentic.
- Ask your Holcim contacts directly. UK and other partners should ask their account manager whether their data was in scope, and record the request so they are ready if regulatory notifications follow.
- Keep OT separate from IT, and test it. Holcim says its industrial control systems were untouched. Industrial firms should check that their own separation between IT and OT networks would hold up the same way, and that offline backups can be restored quickly.
Sources: Holcim confirms data theft after Emperador claims 360GB haul - SECN... | Hackers claim 360 GB stolen from cement giant Holcim, which admits... | Ransomware Emperador greift Holcim an: Was Sie wissen müssen | Emperador ransomware group claims attack on Swiss multinational Hol... | Holcim Reports Limited Unauthorized Data Exfiltration Incident Mar... | Holcim: hacker sottraggono grande quantità dati MarketScreener Italia | Hacker erbeuten 360 Gigabyte Daten von Holcim SwissCybersecurity.net | Hacker erbeuten große Datenmenge bei Cyberangriff auf Schweizer Bau...