CommTank
October 30, 2026
•[ ransomware, technology ]
CommTank was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: United States of America. Website: commtank.com. commtank.com CommTank Inc is a US storage tank contractor founded in 1997 in Winchester, Massachusetts, specializing in installation, removal, inspection and maintenance of underground and aboveground storage tanks across New England and the Mid-Atlantic. With 50 to 100 employees and estimated revenue of 10 to 25 million dollars, it serves government facilities, hospitals, schools and industrial clients across 8 states. Its services cover the full tank lifecycle including UST and AST installation, leak testing, cathodic protection, soil remediation and emergency spill response. Led by founder Rick Connolly, it holds EPA, MA DEP, CT DEEP and NFPA certifications and runs its own field crews without subcontracting core work. It also provides Phase I and II environmental site assessments and SPCC compliance planning. The company has built a niche in high-barrier tank services requiring specialized licensing and regulatory expertise.
GIO Dental
October 28, 2026
•[ ransomware, healthcare, technology ]
GIO Dental was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Healthcare. Country: Sierra Leone. Website: giodentalsl.com. giodentalsl.com GIO Dental SL is a modern dental clinic and laboratory founded by Nigerian dentist Dr. Gift Nwachukwu Obiorah in Freetown, Sierra Leone, with an additional location in Koidu, Kono District. It is Sierra Leone's first fully integrated dental provider offering clinical treatment, a prosthetics laboratory, dental technology education and equipment repair under one brand. Services span general and cosmetic dentistry, orthodontics, oral surgery, custom prosthetics fabrication and community oral health programs. Led by founder Dr. Gio, the company trains local dental technicians and runs outreach campaigns to make premium dental care accessible across the country. Its vertical model combining treatment, manufacturing and education is unique in the Sierra Leonean healthcare market. It also provides equipment repair and supply services to other dental clinics in the region.
Grundbaulabor Trier
October 26, 2026
•[ ransomware, manufacturing, leak ]
Grundbaulabor Trier was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Germany. Website: gbl-trier.de. gbl-trier.de Grundbaulabor Trier is a German geotechnical engineering firm founded in 1960 in Trier by Dr. Paul Lehmann, now run by the third generation of the Lehmann family with 23 qualified engineers. It has completed over 20,000 projects in soil investigation, foundation design, construction supervision, environmental contamination assessment and hydrogeology across Rhineland-Palatinate, Saarland and Luxembourg. The firm operates its own soil mechanics laboratory offering fast and reliable sample processing with modern testing equipment. Led by Managing Directors Eric Lehmann and Bernd Mertes, it is one of the leading geotechnical bureaus in the Trier-Saarbrcken-Luxembourg region.
SOME
October 26, 2026
•[ ransomware, technology, manufacturing ]
SOME was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Country: Italy. Website: some.it. some.it SOME Srl is an Italian ERP and financial systems consulting company founded in 2001 in Milan, delivering end-to-end implementations of Epicor Kinetic, Infor SunSystems and Fluentis ERP for manufacturing, hospitality and oil and gas clients. With about 22 employees and revenue of 2.8 million euro, it has completed over 100 implementations across Europe, the Americas and North Africa. The company operates both as a system designer building ERP architectures and as a local specialist adapting global models to Italian fiscal and regulatory requirements. Led by Sales Director Franco Giannini and Partner Hussein Bahobeshi with 25 years of hospitality ERP expertise, it serves international hotel chains, oil companies like Mellitah and ENI Congo, and mid-size manufacturers.
SAP
October 26, 2026
•[ ransomware, technology ]
SAP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: Germany. Website: sap.com. sap.com SAP Latin America and Caribbean is the regional arm of SAP SE, the world's largest enterprise software company, managing operations across 10 countries with about 6,000 employees led by President Adriana Aroulho since April 2025. Brazil is the standout market, cited in 40 straight quarters of global earnings for exceptional cloud revenue growth and now having more customers running on cloud than on-premise. The region serves over 5,000 clients in Brazil alone and holds 50 percent share among large Brazilian enterprises, with major wins including Grupo Nutresa, Honda South America, Votorantim, Chedraui and Motta Internacional. Through RISE with SAP and GROW with SAP, the company drives cloud ERP migration and Business AI adoption with its Joule assistant, targeting up to 30 percent productivity gains for clients. SAP's global cloud revenue reached 6.7 billion euro in Q3 2026 with the LatAm cloud market projected to double to 125 billion dollars by 2030.
WABAG
October 26, 2026
•[ ransomware, energy, technology ]
WABAG was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Energy & Utilities. Country: India. Website: wabag.in. wabag.in VA Tech WABAG is the world's leading pure-play water technology company, founded in 1924 and headquartered in Chennai, India, operating in over 25 countries with 2000 engineers and over 1500 plants delivered. Listed on NSE and BSE, it posted record FY2026 revenue of 3944 crore rupees with PAT of 371 crore and has been net cash positive for 6 straight years with a credit rating of AA minus stable. Its order book surged to an all time high of 19400 crore rupees in Q1 FY2027, over 4 times annual revenue, backed by World Bank, ADB and JICA funded projects across India, the Middle East, Africa and Southeast Asia. Key projects include Southeast Asia's largest 400 MLD desalination plant in Chennai and a 300 MLD mega desalination order in Saudi Arabia. The company holds 125 plus proprietary patents and ranks 3rd globally among private water operators and desalination suppliers per Global Water Intelligence. Led by Chairman Rajiv Mittal.
StarImage
October 26, 2026
•[ ransomware, healthcare, technology ]
StarImage was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: United States of America. Website: starimagesouthlake.com. starimagesouthlake.com StarImage Dental Boutique & Oral Surgery is a premium dental practice in Southlake, Texas, opened in January 2021 as the second location of StarImage Dentistry founded by Dr. James Green in Wichita Falls over 25 years ago. Led by Dr. Green, oral surgeon Dr. Dustin Van Tassell and Dr. Susan Millner, it offers cosmetic and reconstructive dentistry, dental implants, full mouth rehabilitation, oral surgery, TMJ treatment and sleep apnea care all under one roof. The clinic is one of the most technologically advanced dental offices in the US, equipped with Planmeca ProMax 3D CBCT imaging, MLS laser therapy, VELscope cancer screening and CT-guided implant surgery. Both lead doctors hold Fellow status at the Las Vegas Institute for Advanced Dental Studies, and the practice maintains a perfect 5.0 rating across 50 plus reviews. Its dedicated TMJ and Sleep Center provides a high-margin specialization in jaw disorders and obstructive sleep apnea.
Surexport
October 26, 2026
•[ ransomware, manufacturing, retail ]
Surexport was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Spain. Website: surexport.es. surexport.es Surexport is the largest independent berry producer in Europe, founded in 1994 in Huelva, Spain, growing strawberries, raspberries, blueberries and blackberries across Spain, Portugal, the Netherlands, Morocco and Kenya. Owned since 2020 by Alantra Private Equity, the group is valued at around 600 million euros with revenue approaching 400 million and over 2500 employees. Its competitive edge is exclusive berry varieties developed with US genetics partner Plant Sciences since 2007, sold under the Doarosa, Berry Sensations and Fruhi brands. Major clients include Tesco, Lidl, Mercadona and Sainsbury's, with 80 percent of revenue from exports to Northern Europe. The company invested 200 million euros in acquisitions and secured a 250 million euro loan in 2025.
Marie Kruses Skole
October 26, 2026
•[ ransomware, education ]
Marie Kruses Skole was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Education. Country: Denmark. Website: mks.dk. mks.dk Marie Kruses Skole is a private school in Farum, Denmark, founded in 1869 by education pioneer Marie Kruse, offering a full track from kindergarten through gymnasium STX to about 1100 students. It is the only free primary school and the only gymnasium in Fures Kommune, employing 107 people and led by rektor Carsten Gade. The school runs 8 gymnasium study lines including Biotek, Mat-Fys, sports, business, super languages and music, plus unique programs like Kruse Elitesport and diving. Revenue in 2024 reached 109.5 million Danish kroner with a 1.4 million profit, backed by 68 percent state subsidy and a stable surplus for 5 straight years. Tuition is 2190 kroner per month with financial aid available, and it attracts over 1100 students on its waiting list. Its key strengths are 157 years of heritage, top national exam results and free admissions independent of municipal student distribution rules.
Pac Production
October 26, 2026
•[ ransomware, energy, technology ]
Pac Production was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Sweden. Website: pac.se. pac.se PAC Group is a Swedish power plant automation company founded in 1979 in Stockholm, delivering control systems, simulation and optimization solutions for thermal, hydro, nuclear and renewable power plants. It has completed over 600 projects on more than 100 power plants across 50 countries with a combined capacity exceeding 110 gigawatts. Its product portfolio includes PAC Control, PAC-Sim full scope simulators, PAC-Balance and the ARTOCloud optimization platform, plus engineering, commissioning and cybersecurity services. The company is independent from major DCS vendors like Siemens and Emerson, giving it flexibility to integrate any technology. Led by CEO Mikael Andersson, many engineers have been with PAC for 20 to 34 years, ensuring deep institutional expertise. New directions include hydrogen power plants, battery energy storage, hybrid plant control and digital twin solutions.
smithandcasady.com
October 15, 2026
•[ ransomware, manufacturing, energy ]
smithandcasady.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: United States of America. Website: smithandcasady.com. Inside: a subcontract agreement and insurance requirements from general contractor Charles Perry Partners, Inc. (CPPI, Gainesville); commercial invoices for the export of insulation materials to the U.S. Virgin Islands (HOVENSA LLC, oil refinery, Christiansted); cost estimate sheets for FOAMGLAS, Armaflex, and aluminum jacketing covering dozens of projects from Tampa to Hollywood; bid proposals for the insulation of a Raytheon PCS classified facility, "Classified NE Operations A"; correspondence on the Raymond James Stadium project with Manhattan Construction and BCH Mechanical a dispute ove
uaa.mx
October 31, 2026
•[ ransomware, education ]
uaa.mx was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: Mexico. Website: uaa.mx. It provides undergraduate and postgraduate education across a broad range of academic disciplines, including engineering, natural sciences, health sciences, social
quevedo-ponce.com
October 31, 2026
•[ ransomware, leak ]
quevedo-ponce.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Ecuador. Website: quevedo-ponce.com. Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuador
Gamdom V2
October 31, 2026
•[ ransomware, technology, leak ]
Gamdom V2 was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. An Insight into Gamdom's Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
- The 15.4 million entries will be leaked in the same format as below.
- The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
- All support chats and photos shared in the support chat are in my possession; see the samples below.
- The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER Founder
- Admin uid 16259643 "Felix aka Howly" last IP 13.250.207.55 (Aug 19) net +859,966,343 sats
- Legacy supadm uid 3356423 - PHONE +49175804570
- Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down.
5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)
October 31, 2026
•[ ransomware, leak, government ]
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Government & Defense. Country: Germany. SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) is a state-owned land development company belonging to the German federal state of Saxony-Anhalt. The organization specializes in urban and regional planning, brownfield redevelopment, land resource management, and the support of infrastructure projects. It operates as a service partner for local municipalities, coordinating and implementing spatial development programs in the interests of the public sector.
Straze Garden Center
October 31, 2026
•[ ransomware, retail ]
Straze Garden Center was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Straze Garden Center is a German company operating a garden center and an online store for gardening supplies. The business specializes in selling indoor and outdoor plants, planting materials, soils, fertilizers, and garden tools. It provides on-site retail sales as well as order delivery across Germany.
Italtel Peru
September 1, 2026
•[ ransomware, technology, leak ]
Italtel Peru was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Peru. [AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market.
Rise UP
September 1, 2026
•[ ransomware, technology ]
Rise UP was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Website: riseup.ai.
Lawter
September 1, 2026
•[ ransomware, manufacturing ]
Lawter was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Manufacturing. Country: United States of America. Website: lawter.com. Organization with 150 emails extracted. Domain: lawter.com
transportesmontejo.com
September 1, 2026
•[ ransomware, leak ]
transportesmontejo.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Transportation. Country: Mexico. Website: transportesmontejo.com. Transportes Montejo S.A.S. is a Colombian specialized heavy transport and logistics company established on June 7, 1988,...
