Verify a decision

{"actor":"system:backfill","investigation_id":"e607c65e-601c-4f0c-a1d9-c40306846fea","kind":"publish","page_slug":"whitearmor","published_at":"2026-11-04T12:27:27.846Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"WhiteArmor","sections":[{"content":"On October 26, 2026, WhiteArmor posted a listing on its leak site demanding $15 million in Bitcoin from crypto casino Gamdom, claiming to possess a database of approximately 15.4 million customer accounts obtained via an old internal machine account that allegedly retained administrator privileges for years. WhiteArmor published a sample of roughly 100 records (a file of about 437 KB) as alleged proof. Gamdom founder Felix Romer disputed the scale of the claimed breach. No outlet has independently verified the full scope of the alleged data, and there is no public confirmation that a ransom was paid. Gamdom separately disclosed a hot-wallet attack in October 2026 reported to have cost several million dollars, though it is unclear whether the two incidents are related.","heading":"Alleged Gamdom Extortion ($15M Bitcoin Demand)","severity":"high","sources":[{"credibility":2,"name":"WhiteArmor Demands $15M Bitcoin From Gamdom - Gambling.com","type":"news_article","url":"https://www.gambling.com/news/esports/whitearmor-demands-15m-bitcoin-from-gamdom"},{"credibility":2,"name":"WhiteArmor demands $15m in bitcoin from crypto casino Gamdom - crypto.news","type":"news_article","url":"https://crypto.news/whitearmor-demands-15m-in-bitcoin-from-crypto-casino-gamdom/"},{"credibility":2,"name":"Gamdom Faces USD 15M Bitcoin Ransom Over Claimed 15.4M Accounts - Analytics Insight","type":"news_article","url":"https://www.analyticsinsight.net/news/gamdom-faces-usd-15m-bitcoin-ransom-over-claimed-154m-accounts"}]},{"content":"WhiteArmor separately claimed to have stolen approximately 19GB of data from electronics maker Hisense, covering alleged warranty operations in Malaysia and Singapore including customer records, invoices, contracts, and supplier information, and demanded $5 million in Bitcoin. The group posted a sample file of about 348KB, which was reported inaccessible at the time due to an unresponsive hosting server. Hisense had not issued a public statement confirming or denying the claim as of the reporting reviewed. This incident indicates the group's extortion activity is not limited to crypto-sector targets, though it reportedly settles ransom demands in Bitcoin across victims.","heading":"Alleged Hisense Data Theft ($5M Demand)","severity":"medium","sources":[{"credibility":2,"name":"Hisense faces $5 million ransom demand over alleged 19GB data theft - Cybernews","type":"news_article","url":"https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/"},{"credibility":2,"name":"WhiteArmor Gang Claims 19GB Hisense Data Theft, Demands $5 Million - Daily Security Review","type":"news_article","url":"https://dailysecurityreview.com/?p=45009"},{"credibility":2,"name":"Hisense USA Allegedly Breached, Customer Data Exposed - CyberInsider","type":"news_article","url":"https://cyberinsider.com/hisense-usa-allegedly-breached-customer-data-exposed/"}]},{"content":"WhiteArmor advertises an affiliate program recruiting hackers and security specialists, under which affiliates reportedly keep 95% of successful ransom payments while WhiteArmor retains a 5% cut. This structure is characteristic of ransomware-as-a-service (RaaS) operations, which scale by outsourcing intrusion work to independent affiliates in exchange for a share of extortion proceeds. Ransomware-tracking services describe WhiteArmor as an emerging, active group, though they advise treating its claims with caution pending independent verification.","heading":"Ransomware-as-a-Service Affiliate Program","severity":"high","sources":[{"credibility":2,"name":"Ransomware Intelligence — WhiteArmor (SOCRadar)","type":"research","url":"https://socradar.io/free-tools/ransomware-intelligence/victims/whitearmor-cc-whitearmor-3fb45fb7"},{"credibility":2,"name":"WatchGuard Ransomware Tracker — WhiteArmor","type":"research","url":"https://www.watchguard.com/fr/wgrd-security-hub/ransomware-tracker/whitearmor"}]},{"content":"As of early November 2026, WhiteArmor's claims against Gamdom and Hisense remain unverified by independent third parties, and reporting indicates the group's leak site has only a small number of listings. Tracking services note the group was first observed in ransomware-monitoring feeds around October 21-22, 2026, and that it has also listed appliance maker Whirlpool as an alleged victim. No regulatory action, law-enforcement indictment, or confirmed ransom payment tied to WhiteArmor has been reported. Given the group's recent emergence, limited independent corroboration, and reliance on self-published leak-site claims, all figures attributed to WhiteArmor (victim counts, data volumes, ransom amounts) should be treated as unverified allegations rather than established fact.","heading":"Verification Status and Additional Claimed Victims","severity":"medium","sources":[{"credibility":2,"name":"Hisense faces $5 million ransom demand over alleged 19GB data theft - Cybernews","type":"news_article","url":"https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/"},{"credibility":2,"name":"Ransomware Intelligence — Hisense/WhiteArmor (SOCRadar)","type":"research","url":"https://socradar.io/free-tools/ransomware-intelligence/victims/hisense-whitearmor-d29ee754"},{"credibility":2,"name":"Breachsense — WhiteArmor ransomware group profile","type":"research","url":"https://www.breachsense.com/ransomware-groups/whitearmor/"}]}],"sources_used":[{"credibility":2,"name":"WhiteArmor Demands $15M Bitcoin From Gamdom - Gambling.com","type":"news_article","url":"https://www.gambling.com/news/esports/whitearmor-demands-15m-bitcoin-from-gamdom"},{"credibility":2,"name":"WhiteArmor demands $15m in bitcoin from crypto casino Gamdom - crypto.news","type":"news_article","url":"https://crypto.news/whitearmor-demands-15m-in-bitcoin-from-crypto-casino-gamdom/"},{"credibility":2,"name":"Gamdom Faces USD 15M Bitcoin Ransom Over Claimed 15.4M Accounts - Analytics Insight","type":"news_article","url":"https://www.analyticsinsight.net/news/gamdom-faces-usd-15m-bitcoin-ransom-over-claimed-154m-accounts"},{"credibility":2,"name":"Hisense faces $5 million ransom demand over alleged 19GB data theft - Cybernews","type":"news_article","url":"https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/"},{"credibility":2,"name":"WhiteArmor Gang Claims 19GB Hisense Data Theft, Demands $5 Million - Daily Security Review","type":"news_article","url":"https://dailysecurityreview.com/?p=45009"},{"credibility":2,"name":"Hisense USA Allegedly Breached, Customer Data Exposed - CyberInsider","type":"news_article","url":"https://cyberinsider.com/hisense-usa-allegedly-breached-customer-data-exposed/"},{"credibility":2,"name":"Ransomware Intelligence — WhiteArmor (SOCRadar)","type":"research","url":"https://socradar.io/free-tools/ransomware-intelligence/victims/whitearmor-cc-whitearmor-3fb45fb7"},{"credibility":2,"name":"WatchGuard Ransomware Tracker — WhiteArmor","type":"research","url":"https://www.watchguard.com/fr/wgrd-security-hub/ransomware-tracker/whitearmor"},{"credibility":2,"name":"Breachsense — WhiteArmor ransomware group profile","type":"research","url":"https://www.breachsense.com/ransomware-groups/whitearmor/"},{"credibility":2,"name":"Ransomware Intelligence — Hisense/WhiteArmor (SOCRadar)","type":"research","url":"https://socradar.io/free-tools/ransomware-intelligence/victims/hisense-whitearmor-d29ee754"}],"summary":"WhiteArmor is a ransomware and data-extortion group that surfaced around October 2026, demanding Bitcoin ransoms from breached organizations and advertising an affiliate program offering hackers 95% of ransom proceeds. Its highest-profile alleged crypto-sector target is the crypto casino Gamdom, from which it demanded $15 million in Bitcoin over a claimed 15.4 million-account database; Gamdom disputes the scale of the claim. No independent verification of the group's data claims, ransom payment, or law-enforcement action has been reported as of this investigation.","timeline":[{"date":"2026-10","date_original":"2026-10-21","event":"WhiteArmor first appears in ransomware-monitoring feeds, with its earliest claimed victim listing recorded around this date.","source":"Cybernews / Breachsense ransomware tracking","source_url":"https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/"},{"date":"2026-10","event":"WhiteArmor claims a data-theft intrusion against electronics maker Hisense, alleging 19GB of stolen warranty data from Malaysia and Singapore operations, and demands $5 million in Bitcoin.","source":"Daily Security Review / Cybernews","source_url":"https://dailysecurityreview.com/?p=45009"},{"date":"2026-10","date_original":"2026-10-26","event":"WhiteArmor posts a leak-site listing demanding $15 million in Bitcoin from crypto casino Gamdom, claiming access to a database of about 15.4 million customer accounts.","source":"Gambling.com","source_url":"https://www.gambling.com/news/esports/whitearmor-demands-15m-bitcoin-from-gamdom"}]},"v":1}