Holcim, the Zug-based building materials group, has confirmed a cyberattack and a data theft, according to the IT magazine ICTjournal on 4 November 2026. The ransomware group Emperador claims to have stolen 360 gigabytes (GB) of data and is threatening to publish it. Holcim says its production and deliveries are not affected. The nature of the stolen data remains unknown.

Holcim cyberattack: what is confirmed, what is claimed

Two voices are speaking, and they do not carry the same weight. ICTjournal relays information from Inside IT, a specialist outlet that questioned Holcim. The group confirmed to it that it had detected "unauthorised and limited access" to its data, as well as a theft of information. It does not say which information.

Holcim also states that the attack affected neither its industrial control systems, nor its production sites, nor its logistics networks. Its operations and deliveries to customers are continuing without restriction, according to the group. As soon as the incident was discovered, its security teams took measures to contain it and launched an investigation.

The volume of 360 GB and the threat of publication, on the other hand, come from the hackers. None of the available sources has verified them.

ItemStatusWho says so
Unauthorised and limited access to dataConfirmedHolcim, questioned by Inside IT
Theft of informationConfirmed, without detailsHolcim, questioned by Inside IT
Production, sites and logistics sparedStatedHolcim
Theft of 360 GB of dataClaimedEmperador
Threat of publicationClaimedEmperador
Around 80 attacks since AugustReported, not verifiedInside IT
Ransom demandUnknownNo information

The business that Holcim says has been spared carries considerable weight. The group led by Miljan Gutovic generated CHF 4.66 billion in revenue in the third quarter of 2026 alone, according to its results published on 23 October 2026 and relayed by the AWP news agency.

How does double extortion work?

Emperador belongs to the family of ransomware groups. According to Inside IT, cited by ICTjournal, its operators have reportedly only been active since August, but have already carried out around 80 attacks. These figures are the outlet's, not those of an authority.

These groups often resort to double extortion, ICTjournal points out. They steal data and at the same time encrypt the victim's systems. They then demand a ransom, both to decrypt the systems and to refrain from disclosing the stolen information.

The threat of publication is the main lever. The Office of the Attorney General of Switzerland, the Federal Office of Police (fedpol) and the Federal Office for Cybersecurity (FOCS) described it in a press release of 16 October 2025, covered in our guide to ransomware in businesses. If the ransom is not paid within the set deadline, the data is published on a darknet leak site.

Holcim makes no mention of its systems being encrypted. The group speaks of access to its data and of a theft, not of its operations being blocked. According to ICTjournal, there is no information to say whether a ransom has been demanded.

A hackers' claim is not proof. During the wave of claimed leaks in France on 17 October 2026, most of the announced figures remained to be confirmed. Our analysis: a volume of 360 GB says nothing, on its own, about the content of the files or the people concerned.

Does Holcim have to report the cyberattack to the FOCS?

Since 1 April 2025, operators of critical infrastructure must report a cyberattack to the FOCS within 24 hours of its detection. The Federal Council decided this on 7 March 2025, according to its press release. These reports are intended to enable the FOCS to help the victim and to warn other operators early.

The FOCS page "Who must report?" lists several categories subject to the obligation. These include in particular companies in the energy and drinking water supply sectors, transport companies and cantonal or municipal authorities. The full list appears in Article 74b of the Information Security Act (ISA). The Cybersecurity Ordinance (CSO) sets out the exceptions.

Building materials do not appear among the examples cited by the FOCS. Holcim has not said whether any of its companies is subject to the obligation, nor whether it has reported the attack to the office. Our analysis: without these details, it is impossible to assert either that the group was required to report, or that it was not.

Other reports exist outside this obligation. A company that does not operate critical infrastructure can report an attack to the FOCS voluntarily, with no deadline imposed. A data security breach that poses a high risk to the people concerned must be reported to the Federal Data Protection and Information Commissioner (FDPIC), under Article 24 of the Data Protection Act. Our guide to building a cyberattack response plan details these steps.

Ransomware in businesses: the situation in Switzerland in 2026

The number of ransomware attacks remains stable in Switzerland. According to the FOCS press release of 24 August 2026 on its semi-annual report, it stagnated at 79 in the first half of 2026. The office observes a marked diversification and fragmentation of ransomware families.

The reporting obligation now produces regular figures. In the first half of 2026, the FOCS received 200 reports from critical infrastructure. The public sector (19.4%) and the IT and telecommunications sector (18.6%) account for the largest share. Data leaks represent 12.7% of the reported attacks, as many as attacks on the availability of services (DDoS).

The system gained momentum from its very first year. The Confederation's press release of 30 March 2026 counted 325 mandatory reports since its entry into force, including 145 in the second half of 2025.

Holcim adds to a series of data thefts in Switzerland this autumn. At the end of September 2026, data from the City of Zurich's pension fund was stolen from an external software provider. On 23 October 2026, the Federal Commissioner opened an investigation into PK Softech, a software supplier to several pension funds. The attack on its infrastructure led in particular to a data leak at Publica, the Federal Pension Fund. These cases have not been attributed to a ransomware group.

The canton of Vaud, for its part, made its reports public. After the cyberattack on the canton of Vaud, announced on 31 October 2026, it reported the incident to the FOCS and to its data protection authority. Other Swiss cases can be found in our section on IT threats and attacks.

What should Holcim's customers and suppliers watch out for?

As long as Holcim does not specify the nature of the data, no one knows who is affected. Recent Swiss cases nevertheless point to a recurring risk. After the data thefts at the pension funds and the canton of Vaud, 2clics had already noted that a leak can make a fraudulent message more credible.

Our analysis: a Holcim customer or supplier would do well to treat with caution any unusual message claiming to come from the group. The canton of Vaud gave its users simple instructions: never disclose your password, be wary of urgent or unusual messages, report any suspicious message.

What we do not know yet

  • The nature of the stolen data: Holcim has not specified it, and the volume of 360 GB has been confirmed by no one other than Emperador.
  • A possible ransom demand: there is no information to say whether one has been made.
  • Reports to the authorities: Holcim has not said whether it reported the attack to the FOCS or to the Federal Commissioner.

Sources