JS Contractor Inc. Listed on EMPERADOR Ransomware Leak Site
MANILA, Philippines — EMPERADOR ransomware has claimed responsibility for an alleged cyberattack against JS Contractor Inc., a Philippine recruitment and manpower agency, listing approximately 153GB of purportedly stolen data on its leak site on October 23, 2026.
According to the listing, the attackers claim to have obtained company files and databases containing sensitive information, including more than 150,000 resumes and applicants' vaccination records. The group is threatening to publish the allegedly stolen information unless the company contacts them.
The ransomware group's listing includes four archives marked for publication: VACC_DIR.zip (22.8GB), doc_dir.zip (102.6GB), JSCON.COM.PH_DATABASE.zip (626MB), and DOC_DIR_2026.zip (27GB). Their combined size is consistent with the approximately 153GB advertised by the attackers.
Screenshots accompanying the listing show what appear to be résumé documents and a large database spreadsheet presented as evidence of the alleged compromise. A 4.2MB sample archive is also listed on the page. The attackers' post also displays a countdown timer of approximately 20 days and warns that the alleged exposure could lead to identity theft and reputational damage. The initial access method, date of intrusion, and full scope of the alleged data theft remain unknown.
JS Contractor Inc., established in 1977, specializes in recruiting, screening, processing, and deploying Filipino workers for overseas employment. If the claims are substantiated, the alleged compromise could expose personal information belonging to job applicants and other individuals whose records are held by the agency.
As of publication, the available evidence consists of the ransomware group's own claims and screenshots of its leak-site listing. No independent confirmation of the breach or public response from the company has been established.
