Holcim acknowledges limited cyberattack as teams contain incident without disrupting production
Key Facts
Holcim acknowledged a cyberattack, describing the incident as a "limited unauthorized data leak," according to AWP via Zonebourse. The company’s confirmation came after ransomware group Imperador listed its name on its leak site on 31 October 2026, according to Orbitalay. The claim had not been publicly confirmed by the company or another source when Orbitalay published its report on the listing. AWP attributed the theft of the dataset to Imperador, saying the group had threatened to publish it. Inside IT estimated the stolen data at more than 360 gigabytes, according to the same report.
Holcim said its security teams contained the incident as soon as it was detected and began an investigation to assess the contents of the files concerned and compliance with privacy laws. The company added that the leak was limited in scope, but did not specify in the reported statement the number of files or the nature of the information involved. Inside IT’s estimate points to a dataset exceeding 360 gigabytes, while the leak post itself did not specify the amount of data the group claimed to have obtained. Brandefense recorded one claim involving Holcim as of 3 November 2026. The attribution and volume of the data cited in the report remain claims by the group and media coverage, rather than detailed disclosure by the company.
Holcim said industrial control systems, production sites and logistics networks were unaffected by the incident. It said its business activity and customer supplies were continuing without restrictions, putting operational continuity at the center of its initial response. The company said the investigation was intended to examine and assess the files concerned in detail, as well as meet privacy laws and regulations. The reported statements included no estimate of direct financial impact, and the company did not link the incident to any change in production or deliveries. The operational impact disclosed so far is therefore limited to the data leak, with the company affirming that business activity and supplies continue without restrictions.
Imperador appeared in August 2026, and its first post on the leak site was dated 10 August, according to Orbitalay. The agency described it as a ransomware group using double extortion, and attributed the theft of Holcim data and the threat to publish it to the group. The company’s listing on the group’s site on 31 October forms part of this reported activity, but Brandefense’s record shows only one claim involving Holcim as of 3 November. In its 2025 annual governance and risk report, the company said it used a resilient technology infrastructure for critical systems, along with backup and disaster recovery procedures. It also said it relied on measures to detect and respond to unusual activity on its networks.
Holcim shares, traded under the ticker HCMLY, closed at $17.3 on 2 November 2026, according to EL7 data, compared with a close of $16.66 on 30 October. The latest close came after the group listed the company on its leak site on 31 October. These prices alone, however, do not establish a market response to the claim, and the available evidence offers no explanation for the share move or estimate of the incident’s effect on the company’s valuation. Holcim had raised its 2026 guidance for organic recurring operating profit growth to 10%-12%, with expected organic sales growth of about 5% and free cash flow of around 2 billion Swiss francs. The company has scheduled publication of its 2026 full-year results for 25 February 2027, followed by a first-quarter 2027 trading update on 23 April.