[ Ransomware claim · emperador · 25 Oct 2026 ]
AB InBev
The ransomware group emperador named AB InBev (Belgium) on its leak site on 25 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from AB InBev and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is AB InBev?
- What it does
- AB InBev (Anheuser-Busch InBev) is a Belgian multinational brewer that makes and sells beer and soft drinks, and describes itself as the largest brewer in the world. Its brands include Stella Artois, Jupiler, Leffe, Hoegaarden, Budweiser and Corona. The ab-inbev.be site is its Belgian website, covering its breweries, beers, careers and sustainability work in Belgium.
- Based in
- Leuven, Flemish Brabant, Belgium
- Founded
- 2004 as InBev, renamed AB InBev after acquiring Anheuser-Busch in 2008
- Size
- about 143,885 employees worldwide (2024); an older company factsheet listed five breweries and about 2,700 employees in Belgium
- Who it serves
- It sells around 630 beer brands in roughly 150 countries to drinkers, bars, restaurants, retailers and distributors. In Belgium it brews in Leuven, Jupille and Hoegaarden among other sites.
[ Impact ]Who could be affected
If the claim were accurate, brewery operations, ordering or distribution could be disrupted, which could delay deliveries to Belgian bars, shops and wholesalers. Employees, job applicants and business partners could also be affected if personal or commercial records were exposed. The listing is a claim by criminals and has not been confirmed.
In agriculture and food production generally: Food supply and deliveries to shops and restaurants can be disrupted, and farmers and suppliers can be affected through shared ordering systems.
[ The attacker ]About emperador
Emperador is a financially motivated extortion group first seen in August 2026 that runs a dark web leak site and uses double extortion, taking data before making demands. Security researchers report it gains access through phishing, exposed VPN appliances and reused stolen credentials.
emperador has claimed 23 organisations in the last 30 days, most in Brazil, Italy and Germany, and mostly in retail & e-commerce, manufacturing and professional services. We wrote about the group in Ports, a cloud host and a busy month for extortion.
Other organisations emperador has named
- Uruguay
- Switzerland
- Italy
- Italy
[ What to do ]If you are a customer, partner or neighbour
- Treat unexpected emails, invoices or payment-detail changes that appear to come from AB InBev with caution and confirm them through a known contact.
- Suppliers, distributors and hospitality customers should watch for messages asking for logins, payments or new bank details and report anything unusual to their AB InBev contact.
- Employees and recent job applicants should be alert to phishing that uses their name or role, and consider changing reused passwords.
- Follow official statements on ab-inbev.be or ab-inbev.com rather than claims circulating online.