Whitearmor

Unilever 11/4/2026 07:26 PM Unilever is a British multinational consumer goods company headquartered in London. It owns over 400 brands, including Dove, Knorr, Hellmann's, and Rexona, spanning beauty, personal care, home care, and foods, serving consumers in around 190 countries worldwide. We hold 665K contacts, 5.5K OTM accounts with roles and logins, 14M locations, 3.8M shipments, 229M status records, 13.8K invoices, plus 838K distributor loyalty profiles and ledgers. 79 gigabytes, 1.8 million files, three regions. Unilever7.z is about 79GB decompressed. Our ransom demand is only $15,000,000 in BTC Emails with instructions will be sent to you shortly, if you have failed to receive them, Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] 19d 23:57:36 UNTIL RELEASE 2 FILE(S) 0 ID 36183

AmplifAI (GoDaddy instance) 11/1/2026 01:03 PM GoDaddy AmplifAI Instance — Complete Data Dump ================================================ URL: https://godaddy.ampbi.net Okta SSO: https://godaddy.okta.com Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI) Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7 ============================================================ USER DATABASE — 13,565 unique employees ============================================================ File: all_users.json Fields per user: "name": "", "email": "", "userseq": , "firstname": "", "lastname": "", "ad_id": "", "password": "", "aduser": "true/false", "usertype": "1/2/3/4", "employeenumber": "" User Type Key: 1 = Admin 2 = Manager 4 = Agent Breakdown: Total users: 13,565 AD users (Okta/SSO): 6,184 Non-AD users (local): 16 Admins (type=1): 459 Managers (type=2): 502 Agents (type=4): 5,239 Default password: 13,510 Non-default passwords: 9 ============================================================ ORGANIZATIONS — 34 total ============================================================ 1. Agent Dashboard – Organizations 1. DEM Sales_Support - ALL 2. DEM Sales_Support - GDDY 3. DEM Sales_Support - TP 4. GD International Independents 5. GD US Independents 6. Commerce - GDDY 7. Commerce - TP 8. DEM Sales_Support - SGS 9. EMEA Brands - ALL 10. EMEA Brands - GDDY 11. EMEA Brands - TP 12. GAO - GDDY 13. GD Teleperformance 14. Global Messaging Ops - GDDY 15. Global Messaging Ops - Genpact 16. Global Messaging Ops - SGS 17. Global Messaging Ops - TP 2. Performance Dashboard – Organizations 18. ROW Sales_Support - ALL 19. ROW Sales_Support - Genpact 20. ROW Sales_Support - SGS 21. Services - SGS 22. US Sales_Support - SGS 3. Analytics – Organizations 23. Global Messaging Ops - ALL 24. ROW Sales_Support - TP 25. Services - ALL 26. Services - GDDY 27. Services - TP 28. US Sales_Support - ALL 29. US Sales_Support - GDDY 4. Non Core Care – Organizations 30. US Sales_Support - TP 31. Non Core Care - GDDY 32. Non Core Care - Genpact 33. Non Core Care - SGS 34. Non Core Care - TP ============================================================ LOGIN LOGS — 4,451 records ============================================================ File: login_logs.json Fields per record: "Name": "", "Title": "", "Module": "", "Access Date": "", "Access Time": "", "Time Zone": "", "Access Device": "", "Primary Program": "", "Organization": "", "Location": "", "Manager Name": "", "OpsManager Name": "" Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy Sample devices: Desktop, Mobile ============================================================ ROSTER DATA — 1,201 records (1,193 with @godaddy.com emails) ============================================================ File: roster.json Fields per record: "RosterExportID": "", "companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8", "employeeid": "", "email": "", "fname": "", "lname": "", "managerid": "", "pbxid": null, "location": "", "primaryprogram": "", "title": "", "recorddate": "", "hiredate": null, "termdate": null, "loginuserid": "", "customfield1": null, "customfield2": null, "customfield3": null, "customfield4": null, "customfield5": null, "customfield6": null, "customfield7": null, "customfield8": null, "customfield9": null, "customfield10": null, "otherprogram1": null, "otherprogram2": null, "otherprogram3": null, "otherprogram4": null, "otherprogram5": null, "otherprogram6": null, "otherprogram7": null, "otherprogram8": null, "otherprogram9": null, "otherprogram10": null, "varcharemployeeid": "", "varcharmanagerid": "", "organization": "", "movedToCosmos": "False", "glidepathtitle": null, "gltitleid": null, "coach": null, "programstartdate": null, "RequestID": "" Roster by Organization: US Sales_Support - GDDY: 405 records Global Messaging Ops - Genpact: 191 records EMEA Brands - GDDY: 176 records Commerce - GDDY: 135 records DEM Sales_Support - GDDY: 103 records ROW Sales_Support - SGS: 101 records Commerce - TP: 41 records Non Core Care - Genpact: 37 records Services - TP: 12 records ---------------------------------------- TOTAL: 1,201 records 25 organizations have no roster data available. ============================================================ PROGRAMS — 227 unique GoDaddy call center programs ============================================================ File: programs.json Categories include: Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin) Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS Geographic: UK & IE, CA & AU, LATAM, EMEA, International English Security: Website Security Sales I/II, Website Security Support Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services ============================================================ OKTA / ACTIVE DIRECTORY INTEGRATION ============================================================ Okta Tenant: https://godaddy.okta.com AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7) Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta) SAML SSO: SAML 2.0 OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration Authn API: POST https://godaddy.okta.com/api/v1/authn (accepts JSON {username, password}, returns sessionToken on success) Password Grant: Supported (grant_type=password in OIDC config) AD User Identity Format: "Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin) Okta accepts: username, [email protected], EMAIL format Reach out on session or be the next headline https://getsession.org ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c VIEW POST 7 ID 36050

Gamdom V2 10/31/2026 10:02 AM An Insight into Gamdom's Lies We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean? - The 15.4 million entries will be leaked in the same format as below. - The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format. - All support chats and photos shared in the support chat are in my possession; see the samples below. - The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence). A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case. FELIX ROEMER — Founder - Admin uid 16259643 "Felix aka Howly" · last IP 13.250.207.55 (Aug 19) · net +859,966,343 sats - Legacy supadm uid 3356423 - PHONE +49175804570 - Personal player uid 48242366 ("Felix Roemer", [email protected], same phone) +49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior. PF: What their own code actually shows: 1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet. 2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out. 3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later. 4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down. 5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round. 6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table. TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps. The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026. Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification. Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+ This is your last chance to reach out to us, Gamdom. 8 FILE(S) 13 ID 36017

KTU Shipyard 10/30/2026 08:02 PM Company: PT Karya Teknik Utama (KTU Shipyard) Location: Batam, Indonesia Founded: 1982 Industry: Shipbuilding & Marine Engineering Website: https://ktushipyard.com/ What the company does KTU Shipyard is an Indonesian shipbuilding company specializing in the construction, repair and maintenance of commercial vessels. Its main products and services include: - Tugboats - Barges - Tankers and cargo vessels - Crane barges - Ship repair and maintenance Company size - Privately owned company. - Approximately 501–1,000 employees. - Multiple shipyard facilities in Indonesia. - Claims to have built approximately 2,200 vessels. Annual Revenue ~USD 200 million Key Business Information - Business model: B2B shipbuilding and marine services. - Customers: Shipping companies, marine logistics operators and offshore businesses. - Main market: Indonesia and regional maritime markets. - Competitive advantage: Established shipbuilding experience, multiple facilities and diverse vessel manufacturing capabilities. What was accessed: Internal ticketing systems, All users drive (including business, customer, confidential files over 3tb of data), customer data, etc. You have 20 days to reach out or let it be your downfall. Attatched: Is a sample file from recent user drives, and a screenshot showing POA (proof of access) We can be very reasonable and this can go well or it can not. You can start contact at the email: [email protected] https://gofile.io/d/G981x5Rl https://gofile.io/d/99sTtibR (backup sample files) 19d 23:44:21 UNTIL RELEASE 2 FILE(S) 10 ID 35981

rolly.io 10/29/2026 05:51 PM Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus formulas (rakeback, weekly bonuses), and active player reward systems. We hold 1,364 rolly.gg player PII records with linked on-chain wallets, 430K+ ledger transactions, 11,442 wallet addresses, 155 whale payout maps, 299 deanonymized staff/CTO emails, and 313 internal chat messages. We aren't asking for any ransom, we just thought it was funny to hack a casino that made a joke about Gamdom. 2 FILE(S) 15 ID 35944

Echo.com 10/28/2026 01:05 AM Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America. We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata. We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives. Emails with instructions will be sent to you shortly. Samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] 18d 22:21:01 UNTIL RELEASE 2 FILE(S) 301 ID 35843

Ryder 11/3/2026 05:23 PM Greetings. Ryder has willingly accepted to negotiate with us. Today, we received a message from them saying 'Ohh haha the data is worthless we are willing to offer 50k(pocket change) XDDD We are giving them one more chance to make a decent offer. But anyway, have this for now. 1 FILE(S) 10 ID 35841

Hi, join our telegram channel for fun.. i guess [Telegram link: professional/enterprise only] ID 35840

gamblinglore 10/27/2026 01:35 AM Verification for Gamblinglore.com VIEW POST 448 ID 35813

Gamdom 10/26/2026 04:45 PM Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The way in was something internal, a machine account that was already sitting in their admin side (Metawin). Issued years back, nobody ever rotated it. Never meant to leave the building. It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores. About your provably fair: what it promised and what it delivered were never the same thing. We demand $15,000,000 in BTC. Emails with instructions will be sent to you directly. To verify, a sample can be found below. 11d 14:44:22 UNTIL RELEASE 1 FILE(S) 544 ID 35793

LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue. We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion. Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals. Our demand: $500,000 in BTC or XMR To verify, samples can be found below. ID 35571

You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords.. Fuck you... ;/ ID 35568

Hi, we now have an X account. https://x.com/WhiteArmorxd Also, fuck the AI slop cti reporters lol ID 35563

Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances. We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary. Our demand is $500,000 in BTC. Good luck. Contact: [email protected] Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 ID 35543

Hi! We now have a clearnet domain for easy-access. WhiteArmor.cc ID 35484

Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip Contact: [email protected] Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 ID 35479

J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace. We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email. To verify, samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: [email protected] ID 35480