Emperador

The Bosnia and Herzegovina Mine Action Center is an organization operating within the NGO and associations sector in Bosnia and Herzegovina. It provides specialized mine action services, supporting demining operations, safety protocols, and humanitarian coordination related to hazardous land remediation. As a ransomware victim entity, it is documented within the threat-intelligence index under association with the threat actor emperador. The listing reflects the cybersecurity context of this organization without disclosing unverified incident details, data scope, or operational specifics. This entry serves catalog and analytical purposes for monitoring threat actor activity across vulnerable sectors. ID 32710

important documents [Size: 1.7 GB | Sector: Other] ID 32710

Universal Starch-Chem Allied Ltd operates within the manufacturing and engineering sector, with operations associated with India. The entity represents a business organization whose security posture was impacted by a cyber incident. According to threat-intelligence index records, Universal Starch-Chem Allied Ltd is classified as a ransomware victim associated with the emperador threat actor or source. This listing reflects the entity's documented relationship to this threat actor within the intelligence catalog. No specific incident details, such as data stolen, ransom demands, or confirmed breach metrics, are asserted here, maintaining factual neutrality. ID 32708

important documents [Size: 3.5 GB | Sector: Other] ID 32708

Baymer operates within the United States healthcare and medicine sector, providing medical services and technology solutions focused on clinical workflows and patient care support. As a ransomware victim, Baymer is documented within this threat-intelligence index under association with the Emperador threat actor. The listing reflects the entity's exposure within the cybersecurity landscape and its categorization by sector, geographic location, and attack context. This entry serves to catalog the relationship between Baymer and the Emperador threat actor without disclosing unverified incident details. The record supports threat-intelligence analysis for healthcare organizations facing ransomware risks. ID 32709

Important documents [Size: 1.4 GB | Sector: Other] ID 32709

The Judicial Branch of the Province of Jujuy is a public-sector entity located in the Indian state of Jujuy, functioning within the judicial administration of the province. It provides core legal and judicial services, including civil and criminal case adjudication, legal oversight, and public legal representation for residents within its jurisdiction. As a Public Sector organization in AR, it operates within sensitive governmental infrastructure and delivers essential services to the community. This entity is cataloged in the threat-intelligence index as a ransomware victim associated with the threat actor emperador. The listing reflects the observed relationship between this judicial institution and the identified ransomware campaign without disclosing unverified incident details. ID 32591

The official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digital case management, mediation services, legal rulings, and judicial news for legal professionals and the public. Now i have your wordpress databases, login credentials to internal systems(thanks to marcos :)), as well as your email credentials Respond to us, pay the ransom.(Check your emails & check spam as well.) [Size: 4.2 GB | Sector: Government, Law] ID 32591

Uniguacu is an entity cataloged as a ransomware victim within a threat-intelligence index. Publicly available information does not specify a distinct sector, operational offerings, or geographic location for Uniguacu, so its profile remains limited to its designation as a ransomware incident victim. The listing explicitly associates this entity with the threat actor emperador, linking it to activity attributed to that actor in cybersecurity threat records. No confirmed details regarding stolen data, ransom demands, breach scope, or specific incident outcomes are provided in available sources. This entry serves as a neutral reference point for threat analysts tracking ransomware victims and their associated actors. ID 32268

full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! [Size: 151.0 MB | Sector: Education] ID 32268

full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! [Size: 151.0 MB | Sector: Education] ID 32268

Hanwha Renewables is a South Korean energy-sector company specializing in renewable energy solutions, including solar, wind, and energy storage projects across regional markets. Operating within the critical infrastructure domain of energy, the entity provides clean power generation services and supports sustainable development initiatives. This listing identifies Hanwha Renewables specifically as a ransomware victim linked to the EMPERADOR threat actor. The entry reflects the cyber incident within the threat-intelligence index without disclosing unconfirmed technical details or operational impact specifics. ID 32227

The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. [Size: 11.7 GB | Sector: Energy] ID 32227

revealdata.com operates within the information technology sector based in the United States. The entity serves as a catalog entry within this threat-intelligence index, specifically categorized as a ransomware victim. Its association is tied to the threat actor emperador, providing context for its inclusion in cybersecurity threat monitoring frameworks. This description maintains neutrality regarding incident specifics while documenting the verified listing relationship. The entry supports analytical workflows for threat intelligence professionals tracking ransomware-related entities and actor connections across sectors and geographies. ID 32202

Yes, this data has been posted before by ME under a different alias, yes the individual that posted the data on cracked.st is a fraud. I am posting this just for fun. Data contains: Customer identifiers, Contact & Location, Account metadata, Internal System IDS, Client relationships. The full database backup contains everything such as transcripts, cases, though it is from 2023. [Size: 79.5 MB | Sector: Government, Law] ID 32202

Capitol Mechanics is a United States-based entity operating within the mechanical, industrial, or facility maintenance sector, providing mechanical services, equipment support, or related operational offerings to clients and infrastructure stakeholders. As cataloged in this threat-intelligence index, Capitol Mechanics is listed as a ransomware victim associated with the threat actor emperador. The listing type identifies the entity's relationship to this specific cyber incident without disclosing unconfirmed technical details, data exfiltration specifics, or operational impact. This entry serves to document the association for security researchers, defenders, and intelligence consumers tracking ransomware campaigns and their affected organizations across the United States. ID 32185

Capitol Mechanics , fresh databases, important docs [Size: 120.9 MB | Sector: Finance, Transportation] ID 32185

FRUCASTRO SL is a company operating within the Manufacturing and Engineering sector, headquartered in Spain (country code ES). The entity provides industrial and technical engineering services, aligning with sectors commonly targeted by sophisticated cyber threats. Within the threat-intelligence index, FRUCASTRO SL is formally listed as a ransomware victim associated with the emperador threat actor. This classification reflects the entity's documented exposure within the threat landscape, contributing to broader cybersecurity intelligence for monitoring and defense planning. The entry remains neutral, focusing solely on the association without speculating on unverified incident details. ID 32050

Recent databases, important documents [Size: 540.1 MB | Sector: Manufacturing] ID 32050

Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 [Size: 300.0 GB | Sector: Government, Energy] ID 31935

Test [Size: 740.0 KB | Sector: Other] ID 31962

NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system built for external audiences rather than internal employees. It helps companies train, certify, and enable their channel partners, customers, and association members, with features like certification tracking, self-paced and instructor-led courses, e-commerce, white-labeling, Salesforce integration, and AI-powered course authoring agents. Headquartered in Dallas, with clients including AMD, AT&T, Oracle, Trellix, and Sabre. [Size: 18.1 MB | Sector: Education, Retail, Other] ID 31924

We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated. Critical systems have been encrypted. We have your data. You do not. You have 14 days to respond. No response = data published + permanent loss. Contact us through the provided channel. No third parties. No recovery attempts. [Size: 462.3 MB | Sector: Government] ID 31821

Albania's Official National Teacher Training Portal is a national online platform that provides training and educational resources to teachers in Albania. The portal operates within the education sector, offering various courses and materials to support teacher development and training. It is located in Albania and serves the country's educational community. Albania's Official National Teacher Training Portal was listed as a ransomware victim associated with emperador. ID 31782

Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. [Size: 5.9 GB | Sector: Education, Government] ID 31782

Albania's official national teacher training portal operates in the education sector, providing training and resources to teachers across the country. Located in Albania, the portal offers various programs and materials to support teacher development and improve education quality. It was listed as a ransomware victim associated with emperador. ID 31781

Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. [Size: 5.9 GB | Sector: Education, Government] ID 31781

Baguio.gov.ph is the official website of the city government of Baguio, Philippines, providing various public services and information to its citizens. As a key component of the public sector in the Philippines, the website offers a range of services and resources. Baguio.gov.ph was listed as a ransomware victim associated with emperador ID 31597

The City Government of Baguio stands as one of the wealthiest and most prominent local governments in the Philippines. This leak includes highly sensitive and confidential data, such as official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals, procurement records, and other classified administrative materials. [Size: 2.9 GB | Sector: Government, Finance, Construction] ID 31597