# OnTrac employee data extorted by Emperador

Published: 2026-09-23 · Severity: high · Sectors: transportation, retail
Canonical: https://vorant.io/reports/73b38cd9-5e22-5e58-8470-1793c35c7112/ontrac-employee-data-extorted-by-emperador

> Extortion actor 'emperador' claims theft of 197k OnTrac employee records and demands $1M or will leak the data.

Ransomware.live's leak-site tracker recorded a new victim posting attributed to an extortion actor/group using the alias "emperador," targeting OnTrac, a major U.S. last-mile delivery company formed from the 2021 LaserShip/OnTrac merger. The actor claims to hold a full employee database of approximately 197,000 records containing extensive PII — names, employee/legal-entity identifiers, hire dates, home/mobile/business phone numbers, personal and business email addresses, social media handles, and physical/mailing addresses.

The posting includes a $1,000,000 extortion demand, a threat to publicly post the data if unpaid, and a threat to directly target OnTrac's partners and employees for further pressure. The actor references contact via a messaging session ID and email addresses, and notes that extortion emails were already sent to multiple ontrac.com addresses, indicating direct outreach to employees as a pressure tactic alongside the leak-site posting.

No technical details of the initial intrusion vector, malware used, or encryption activity are provided in this posting — it reads as a data-theft/extortion claim rather than confirmed ransomware deployment. Defenders at OnTrac and its partners should treat this as a credible data-breach claim pending verification, monitor for phishing/social-engineering attempts referencing this incident targeting employees, reset credentials and monitor for use of exposed PII (especially personal emails and phone numbers) in follow-on attacks, and watch for the data appearing on leak sites if the ransom is not paid.

## Mentioned in this report

- Threat actors: emperador

## Detection guidance (public sample)

### Exfiltration of Employee Database via Web Service

ATT&CK: T1567

Detects large data transfers to external web services or cloud storage platforms that may indicate exfiltration of employee records or PII databases. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exfiltration of Employee Database via Web Service
description: Detects network connections from internal systems to external web services
  (file-hosting, cloud storage, messaging platforms) with large data transfers, indicative
  of employee database exfiltration. Generalises on destination port, protocol, and
  transfer patterns rather than specific URLs or threat actor infrastructure.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort:
    - 80
    - 443
    - 8080
    - 8443
    Protocol: tcp
  filter_known_legitimate:
    Image|endswith:
    - \chrome.exe
    - \firefox.exe
    - \iexplore.exe
    - \msedge.exe
    DestinationHostname|endswith:
    - .microsoft.com
    - .google.com
    - .apple.com
    - .windows.net
  condition: selection and not filter_known_legitimate
falsepositives:
- Legitimate cloud backup and sync services (OneDrive, Dropbox, Google Drive) used
  by employees
- Software updates and patch distribution over HTTPS
level: low
id: b93e5975-d8dc-581e-96fc-8d636f358c00
status: experimental
author: Vorant
```

### Reconnaissance of Organizational Structure via Directory Services

ATT&CK: T1591

Detects queries to Active Directory or LDAP services enumerating employee information, groups, and organizational structure — typical precursor to targeted data theft and phishing campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Reconnaissance of Organizational Structure via Directory Services
description: Detects LDAP/Active Directory enumeration queries targeting employee
  objects, phone numbers, email addresses, or organizational group membership. Generalises
  on LDAP filter patterns and query scope rather than specific user names or departments.
tags:
- attack.reconnaissance
- attack.t1591
logsource:
  category: network_connection
  product: windows
detection:
  selection_ldap:
    DestinationPort: 389
    Protocol: tcp
  selection_ldap_filter:
    CommandLine|contains:
    - objectClass=person
    - mail=
    - telephoneNumber
    - memberOf
    - cn=Users
  filter_admin_tools:
    Image|endswith:
    - \adsiedit.msc
    - \ldp.exe
    - \dsquery.exe
  condition: (selection_ldap or selection_ldap_filter) and not filter_admin_tools
falsepositives:
- Active Directory administrative tools (ADSI Edit, LDP, dsquery) used by IT support
  staff
- Directory synchronization services and identity management platforms
level: medium
id: 425baeae-a9d6-5937-a048-86e3e2d1b1a6
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/T25UcmFjQGVtcGVyYWRvcg==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/73b38cd9-5e22-5e58-8470-1793c35c7112/ontrac-employee-data-extorted-by-emperador.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup