Ransomware (extortion): Production and industrial SMEs, Switzerland 2026
At the end of October 2026, the new ransomware group Emperador claimed an attack on the building materials group and threatened to publish around 360 gigabytes of stolen data.
- Incident · 10.2026 · Switzerland
- Evidence: confirmed by an authority
- Ransomware (extortion)
- Data breach
As of
What happened
Holcim confirmed limited unauthorised access and data exfiltration and initiated containment and an investigation. According to Holcim, production, industrial control systems and logistics were not affected.
- Affected
- Holcim
- Industry
- Production and industrial SMEs
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- according to the perpetrators around 360 GB; Holcim confirms limited data exfiltration, which data is still open
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Separate networks for production and office IT keep the plant running when data is exfiltrated.
Sources
- Hacker erbeuten 360 Gigabyte Daten von Holcim (opens in a new window) Netzwoche (gestützt auf inside-it.ch) · 04.11.2026
«Die Produktion und Lieferung von Holcim sind nicht beeinträchtigt.»
- Holcim bestätigt Cyberangriff (opens in a new window) inside-it.ch · 03.11.2026
«Die neue Ransomware-Bande Emperador beansprucht die Attacke für sich.»