Swiss building materials group Holcim has confirmed that attackers accessed and stole some of its data, days after the Emperador ransomware gang listed it on a leak site and claimed roughly 360GB. Holcim has not said what was taken or which countries are affected, a gap that matters to its UK arm and to the many UK construction firms that buy from it.
What happened
On 31 October 2026 the Emperador extortion group added Holcim to its leak site. Ransomware.live, which indexes public postings by ransomware operators, recorded the listing that morning and logged a claimed data volume of 364.2GB. The gang says it will publish the files, the usual pressure tactic when a victim does not pay.
On 3 November Holcim confirmed the incident to the Swiss trade publication Inside IT, and the Swiss news agencies picked the story up. In its statement, reported by cash.ch, Baublatt and Ticinonline, the company said it had found “limited, unauthorised access to data” and the theft of that data. It did not say what the data contains, how many people or business partners might be affected, or how the attackers got in.
Holcim says the attack did not reach its industrial control systems, production sites or logistics networks. It says business operations and customer deliveries are continuing without restriction, that its security team has taken steps to contain the incident, and that an investigation is under way. It has not said publicly whether it received a ransom demand.
The 360GB figure comes from the attackers and has not been verified. Gangs routinely inflate claims to raise pressure, and volume says nothing about how sensitive the files are.
The detail
Holcim is one of the world’s largest building materials businesses. Ransomware.live describes it as a company founded in Switzerland in 1912, supplying cement, aggregates, ready-mix concrete and building solutions across 43 markets, with net sales of CHF 15.7bn in 2025.
Emperador is new. According to Inside IT, as reported by the Swiss agencies, the group has been active only since August 2026 and has claimed around 80 attacks in that time. Readers may remember the name from late October, when Emperador claimed data from brewer AB InBev, a claim we reported at the time as unconfirmed. Holcim is a different case: the victim has now confirmed that data was stolen.
The Swiss reporting notes that ransomware gangs typically use double extortion, stealing data and also encrypting systems. Holcim’s account says nothing about encryption. It refers only to data access and theft, and says operations are running normally. For a heavy industrial firm, keeping operational technology separate from corporate IT is the control that turns a possible shutdown into a data breach, though Holcim has not said how its networks are segmented.
What we do not know matters more. Holcim has not said whether the stolen files are corporate documents, employee records, customer and supplier data, or a mix, which business units or countries are affected, or how the attackers got in.
Why it matters for UK organisations
Holcim has a large UK footprint. Its subsidiary Holcim UK, known as Aggregate Industries until it rebranded in March 2025, is headquartered at Bardon Hill in Leicestershire. It employs about 4,000 people across more than 200 UK sites, supplying aggregates, asphalt, concrete, cement and precast products, along with resurfacing contracting.
To be clear, Holcim has not said that UK data or UK systems are involved. There is no public evidence either way. But a group-level breach at a multinational often touches shared platforms, such as email, HR, finance or document management, that hold records from many countries. If personal data of UK staff, customers or contractors turns up in the stolen set, the UK GDPR obligations fall on whichever group entity is the controller. That would mean reporting to the ICO within 72 hours of becoming aware, and telling individuals without undue delay where the risk to them is high.
The wider exposure is in the supply chain. Holcim UK sells to housebuilders, civil engineering contractors, local authorities and highways programmes. Commercial files from a building materials supplier typically hold contact details, pricing, delivery schedules, site addresses and bank details for invoicing. That is the raw material for invoice redirection fraud. Criminals need only a few genuine names, project references and invoice formats to make a fake “change of bank details” email convincing.
Expert view
In my experience, the first week after a confirmed but unscoped breach is when partners are most exposed. The victim is still working out what left the building, and attackers or opportunists already have the data. When we test supply chain resilience, the weak point is rarely the large firm’s perimeter. It is the accounts payable process at the customer, where a well-crafted email from a “known” supplier contact can still move money.
The statement that production and logistics were untouched is reassuring and, if accurate, reflects well on how the operational estate is ringfenced. But “operations unaffected” is not the same as “no harm”. The harm from a data-theft extortion case is mostly downstream and delayed, and it falls on people who were never in the room.
A group claiming around 80 victims in three months is likely relying on familiar entry points: stolen credentials, unpatched edge devices and remote access without multi-factor authentication. The lesson for UK firms is the same as ever.
What to do now
- If you buy from or supply Holcim or Holcim UK, lock down payment changes. Treat any request to change bank details as suspicious until it is verified by phone on a number you already hold, not one in the email. Brief your accounts payable team today.
- Watch for targeted phishing. Expect emails that cite real orders, sites or contacts. Make sure email filtering and user reporting are working, and remind staff that a genuine-looking thread can still be fraudulent.
- Check your own data-sharing with the supplier. List which systems, portals and shared folders hold data exchanged with Holcim, and rotate any shared credentials or API keys as a precaution.
- Revisit your third-party clauses. Confirm suppliers must notify you promptly of incidents affecting your data, and ask for a written scope update.
- Apply the lesson to your own estate. Map this to Cyber Essentials controls: multi-factor authentication on all remote access and cloud services (user access control), prompt patching of internet-facing devices (security update management), and firewall rules that keep corporate IT and operational technology apart (firewalls and secure configuration).
- Rehearse a data-theft scenario, not only an encryption one. Make sure your incident plan covers the ICO 72-hour clock and the decision on notifying individuals when systems are running but data is gone.
Bottom line
Holcim has confirmed a data theft, and the attackers claim a large haul, but the company has not said what was taken or whether its UK business is involved. Until it does, UK customers and suppliers should assume their commercial contact data could be in circulation and tighten payment verification now. The operational impact looks limited. The fraud risk to the supply chain is where the real exposure lies.
Sources
- Inside IT: Holcim bestätigt Cyberangriff
- cash.ch: Cyberangriff auf Holcim – Hacker erbeuten grosse Datenmenge
- Baublatt: Cyberattacke – Emperador erbeutet 360 Gigabyte Daten von Holcim
- Ticinonline: Attacco hacker a Holcim, rubati 360 GB di dati
- Ransomware.live: Victim listing, Holcim (Emperador)
- Wikipedia: Holcim UK
