# Electrolux exposed in emperador ransomware group claim

Published: 2026-09-19 · Severity: high · Sectors: manufacturing, technology
Canonical: https://vorant.io/reports/244fc028-904b-5880-a684-de4c856d7be5/electrolux-exposed-in-emperador-ransomware-group-claim

> Electrolux targeted by emperador ransomware group; 736 compromised user credentials and exposed external attack surface.

Ransomware.live, a public tracking platform that indexes ransomware operator disclosures, reports that Electrolux appears on the emperador ransomware group's victim listing. The group claims compromised credentials for 736 users and has identified 17 points on the victim's external attack surface. The listing indicates data exfiltration ahead of threatened encryption, a standard tactic in extortion-based ransomware campaigns. No employee credentials from Electrolux staff were listed as compromised in the disclosure. The claim is indexed from publicly visible information posted by the ransomware operator and does not constitute confirmation of active compromise or successful encryption.

## Mentioned in this report

- Threat actors: emperador
- Malware: EMPERADOR

Source reporting: https://www.ransomware.live/id/RWxlY3Ryb2x1eEBlbXBlcmFkb3I=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/244fc028-904b-5880-a684-de4c856d7be5/electrolux-exposed-in-emperador-ransomware-group-claim.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup