Universal Starch-Chem Allied Ltd Data Breach

Universal Starch-Chem Allied Ltd, a manufacturing company based in India that produces industrial starch products and related chemicals, was listed as a victim by the emperador ransomware group on September 9, 2026. This listing was identified through SOCRadar’s Dark Web Monitoring service. The company’s sector and geographic location in India make it a potential target for ransomware operations, given the group’s recent activity patterns. Emperor has claimed 13 other victims in the last 60 days, primarily in the Government & Defense, Manufacturing, and Energy & Utilities sectors. Their most frequent target geographies include Brazil, the United States, and India, with India being one of the group’s most active targets. Other recent organizations listed by emperador include BAYMER, Bosnia and Herzegovina Mine Action Center, Judicial Branch of the Province of Jujuy, and Uniguacu, indicating a pattern of targeting diverse organizations across various sectors and regions.

SOCRadar’s stealer-log telemetry detected a significant exposure for universalstarch[.]com, with 21 classified records. These records included 16 employee credentials on organizational systems and three corporate credentials on third-party services. The Roundcube webmail endpoint, webmail.universalstarch[.]com, was particularly affected, accounting for 12 records associated with two distinct corporate usernames. Further exposure was noted at the root domain and through Google’s authentication service using the same corporate identities. The observed credential freshness spans from June 2024 to September 4, 2026, just days before the emperador listing appeared. The persistence of these credentials across multiple stealer events in 2026, with earlier records being re-logged, indicates a lack of timely rotation. This prolonged exposure period, coupled with the absence of rotation, presents a consistent profile for ransomware operators who often source such access from initial access broker markets. The stealer-log data does not definitively confirm that emperador utilized these specific credentials for an intrusion. However, the extensive exposure window and the persistence of the credentials are consistent with a potential pre-intrusion foothold. Organizations in this situation should prioritize immediate credential rotation and conduct a thorough audit of their mail access logs. Continuous monitoring of dark web stealer logs and webmail endpoints is also recommended.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.