Electrolux Data Breach

Swedish appliance multinational Electrolux (electrolux[.]com) has appeared on Emperador ransomware’s dark web portal for the second time in a 60-day window. The listing was published September 28, 2026, and detected by SOCRadar’s Dark Web Monitoring. A repeated listing from the same actor group is a significant signal, suggesting either unresolved access or a distinct second access path into the organization’s infrastructure. Emperador is an active ransomware group with 29 confirmed victim listings in the past 60 days. Its primary focus is Manufacturing, which is Electrolux’s sector, with geographic concentration in the United States, Brazil, and Sweden. Electrolux operates across all three of these geographies, indicating this is a group that targets organizations fitting Electrolux’s profile. Business Risk: What the Repeated Listing Means The prior listing was a combined “Electrolux & Ontrac” entry. This second standalone listing, if genuine, implies either the earlier negotiation failed or a distinct threat actor obtained separate access. For a company serving more than 60 countries, the exposure surface is significant. Regional subsidiaries, third-party SSO providers, and local VPN endpoints may each represent separate credential pools that a single query against electrolux[.]com wouldn’t capture.

SOCRadar’s query against electrolux[.]com returned no hits. For a global organization of this scale, that’s expected, as regional subdomains and subsidiary domains are out of scope for this specific query. The null result reflects the limits of the query, not the limits of Electrolux’s exposure. The combination of a repeated actor-group listing and globally distributed infrastructure argues for an expanded credential audit across electrolux[.]com, regional subsidiaries, and third-party SSO endpoints. Continued threat-actor tracking on Emperador activity is recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.