Jujuy Judicial Branch Faces Emperador Claim

Update September 11, 2026: SOCRadar added a dedicated entry for the Jujuy case, dates it to September 5, 2026, and treats it as a victim listing, not a breach confirmed by the affected agency. Darkfield, meanwhile, says Emperador claims 4.2 GB, but so far it has only detected 18.1 MB posted on the leak site.

Emperador claimed to have compromised the judicial system of Argentina’s Jujuy province and stolen data. The secondary posting cites 4.2 GB of stolen information, along with WordPress credentials, access credentials, and email credentials. For now, the available evidence comes from monitoring sites and alert accounts, with no independent public confirmation from the agency.

What is known about the claim?

Emperador allegedly listed the case on September 5, 2026, on an extortion site, according to RecentBreaches, which marks it as HIGH severity but classifies it as an unverified claim. The same site says it found no public confirmation from the agency, regulators, or named media outlets about the incident.

The attribution was also echoed by an X monitoring account, TweetThreatNews, which posted that the ransomware had affected the Jujuy Judicial Branch and repeated the 4.2 GB figure. In the same vein, FalconFeeds.io posted an alert on X saying the Judicial Branch of the Province of Jujuy may have been hit by EMPERADOR ransomware.

SOCRadar added the Judicial Branch of the Province of Jujuy to its ransomware intelligence module as a victim attributed to Emperador, with Argentina as the country, Government and Defense as the sector, and a reference to the judiciary’s institutional domain in Jujuy. In another record, the platform specifies that it is a victim listing published on September 5, 2026, not a breach confirmed by the target.

What do Darkfield and RecentBreaches add?

Darkfield, from Orizon, describes the case as a data leak attributed to Emperador in Argentina’s Government and Defense sector. It lists the incident as "Data leaked," with critical severity, and references the exfiltration of judicial infrastructure that would include administrative credentials and court databases, with the group’s operation marked as active.

That same portal adds a new quantitative detail. Although Emperador claims 4.2 GB were exfiltrated, Darkfield says it has so far detected only 18.1 MB actually published on the leak site. It also says the listing text mentions WordPress databases, credentials for internal systems, and email credentials tied to the administrative and case-management infrastructure of the provincial judicial system.

Darkfield adds that the incident involves legal, case, and administrative data at the level of a provincial court system, with exposure of regulated critical infrastructure data in the government and judiciary space. RecentBreaches also keeps the Judicial Branch of the Province of Jujuy in its index with a single entry labeled "unconfirmed breach claim," attributed to September 2026.

Is there technical or official confirmation?

As of TechWalrus’ analysis, there was no public technical write-up detailing how the intrusion happened, which specific systems were affected, or what exact data may have been stolen. The outlet recommended watching future official statements from the Jujuy Judicial Branch to clarify the incident’s real scope.

RecentBreaches classifies the case involving the Judicial Branch of the Province of Jujuy as "HIGH severity, Unverified claim," stressing that it is an allegation on Emperador’s leak site and that the Jujuy judiciary had not publicly confirmed the incident as of its latest update.

The platform also notes, as a technical detail, that the listing mentions exposure of account credentials and that the number of potentially affected people is unknown, so any impact on users remains conditional until reliable confirmation is available.

Emperador’s profile on SOCRadar describes it as a financially motivated extortion gang that emerged in August 2026, with a dedicated leak site on the dark web and a declared focus on municipal public entities and government organizations in LATAM and other regions. TechWalrus covered the case by saying the group claims to have breached the province’s judicial system and stolen data, while noting that no public technical analysis yet exists on the intrusion vector, affected systems, or specific data types.

TechWalrus also provided impact context, saying the most likely affected parties would be litigants, lawyers, court staff, and others with cases or personal records in Jujuy’s judicial system, and that there is no individual patch, only monitoring measures for possible notifications and fraud.

The VenariX en Español account on X said the Judicial Branch of the Province of Jujuy, justiciajujuy.gov.ar, had been posted on Emperador’s blog as a possible ransomware victim, emphasizing the possibility qualifier and the lack of confirmed data. The Ransom-DB account on X also documented that Emperador posted the "Judicial Branch of the Province of Jujuy" as a victim, placing the organization in San Salvador de Jujuy, Argentina, and in the government and judicial services industry.

Grenade’s cybersecurity bulletin, September 7, 2026 edition, included the Jujuy judiciary in a list of at least 44 victims of recent ransomware campaigns in LATAM, alongside McDonald’s Ecuador and other cases, placing it within a broader regional wave.

Is there technical or official confirmation?

As of TechWalrus’ analysis, there was no public technical write-up detailing how the intrusion happened, which specific systems were affected, or what exact data may have been stolen. The outlet recommended watching future official statements from the Jujuy Judicial Branch to clarify the incident’s real scope.

RecentBreaches also keeps the Judicial Branch of the Province of Jujuy in its index with a single entry labeled "unconfirmed breach claim," attributed to September 2026. Taken together, those records leave the case, for now, as an Emperador-linked claim, not an official confirmation.