Hackers claim 360 GB stolen from cement giant Holcim, which admits only a "limited" leak

More than 360 gigabytes on one side, a leak "of limited scope" on the other. On November 3, 2026, the Swiss trade magazine Inside IT revealed that Holcim, one of the world's largest cement and building materials companies, had been hit by a cyberattack. The group confirmed it the same day, but its account and the hackers' remain far apart.

Questioned by the Swiss news agency AWP, Holcim spoke of an "unauthorized data leak of limited scope." It told Inside IT it had detected limited, unauthorized access to data, followed by its theft. Its security teams say they quickly contained the incident once it was detected. An investigation is under way to assess the content of the affected files and to comply with privacy laws.

The plants reportedly run normally

According to the group, industrial control systems, production sites and logistics networks are not affected. Business operations and customer deliveries continue. The risk would therefore concern data, not production.

Who is claiming the attack?

According to Inside IT, the theft is the work of Emperador, a ransomware group (malicious software that encrypts or steals data to demand a ransom). It is threatening to publish the files. The magazine adds that the group has been active only since August and has reportedly carried out about 80 attacks already. It is unknown whether Holcim has received a ransom demand, and no publication deadline has been made public.

The 360 GB figure comes from the hackers alone. It says nothing about how many people are affected or the nature of the files: technical documents, or data on employees, customers or suppliers. Holcim is not commenting on this point.

Best practices for the group's partners

Until the content of the files is known, caution is advised for those who work with Holcim:

• be wary of emails and calls that cite a Holcim invoice, order or construction site to demand an urgent payment;
• verify any request to change a supplier's or customer's bank details through an already known channel;
• for employees, be wary of messages that reuse internal information to appear credible.

What happens next depends on two things: what Holcim's investigation reveals about the stolen files, and what Emperador decides to do with them. If personal data from its European subsidiaries is involved, the GDPR requires notifying data protection authorities and, where the risk is high, the individuals concerned.