Morrison Foerster
October 28, 2026
•[ ransomware, leak ]
Morrison Foerster was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Morrison Foerster is a leading international law firm with a presence in the United States, Asia, and
Becker & Poliakoff
October 29, 2026
•[ ransomware, leak ]
Becker & Poliakoff was listed as a victim on the leak site of the Syntax ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. Country: United States of America. Multi-practice commercial law firm with more than 170 attorneys
Morgan White Group
October 29, 2026
•[ ransomware, finance, leak ]
Morgan White Group was listed as a victim on the leak site of the Shiba ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. Insurance
Fred H Beck & Associates
October 30, 2026
•[ ransomware, leak, finance ]
Fred H Beck & Associates was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. Website: .. A regional commercial real estate services firm based in Charlotte, North Carolina.
Mercantile Investment Corporation Bolivia S A
October 26, 2026
•[ ransomware, leak, finance ]
Mercantile Investment Corporation Bolivia S A was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Financial Services. Country: Bolivia (Plurinational State of). Mercantile & Investment Corporation Bolivia S.A. is a Bolivian broker-dealer and investment house founded in 1983 in La Paz, licensed by ASFI, the national financial regulator, with over 43 years of experience in the Bolivian capital markets. It is the investment arm of international Grupo MIC, offering securities trading, foreign exchange, financial leasing, repo operations, centralized securities custody and discretionary portfolio management. Led by Managing Director Alberto Barrn Michel, it serves institutional investors and corporate clients seeking access to Bolivia's Bolsa Boliviana de Valores. Bolivia's capital market is one of the smallest in Latin America, giving licensed players like MIC a niche with limited competition. Key strengths are full ASFI licensing, international group backing and a comprehensive financial product suite spanning brokerage, leasing and asset management. The firm positions itself as a trusted long-term wealth protector in a market dominated by trade
Betopia Group
October 26, 2026
•[ ransomware, technology, leak ]
Betopia Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Cyprus. Website: betopiagroup.com. betopiagroup.com Betopia Group Betopia Group is a Bangladeshi tech holding based in Dhaka, formally created in July 2025 by consolidating 22 business units including Bdcalling IT, Softvence, Sparktech, JVAI and Zencore, claiming 5,000 employees and 36 million dollars in annual revenue. Founded by Muhammad Monir Hossain, who went from freelancing on oDesk in 2013 to launching Bdcalling IT in 2017 with just 500,000 taka and 7 people, the group now serves clients in over 80 countries with 80 to 90 percent of business from the United States. Its units span software development, AI, cloud infrastructure via ZenexCloud, Odoo ERP implementation, renewable energy through PulseGrid and IT education. In July 2026 the group unveiled Vision 2030, planning to double its workforce and build Betopia City, an AI-powered smart tech hub in Bangladesh. The company is embroiled in a major scandal, with Fiverr suspending around 300 accounts linked to Betopia for coordinated marketplace manipulation.
Ivan Smith Furniture
October 31, 2026
•[ ransomware, retail, leak ]
Ivan Smith Furniture was listed as a victim on the leak site of the sarcoma ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Country: Philippines. For 65 years, Ivan Smith Furniture has believed that great service starts with treating people like neighbors. What began as a small-town furniture store has grown to 40 locations across Louisiana, Texas, and Arkansas, but the values that built our business remain the same.Geo: USA - Leak size: 500 gb - Contains: Files and data bases
Burris & MacOmber
October 27, 2026
•[ ransomware, leak ]
Burris & MacOmber was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. [AI generated] N/A
I don't have reliable, verifiable information about a company called "Burris & MacOmber." I'm not able to confirm its existence, industry, operations, or location, and providing fabricated details would be inaccurate and potentially misleading for threat intelligence purposes. If you have additional context or source material about this entity, I'd be glad to help analyze it.
wagyu.xyz unfairness
October 28, 2026
•[ ransomware, financial, technology ]
wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence:
1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).
2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).
Evidence to support this can be found below:
Insurance Services
October 28, 2026
•[ ransomware, finance, leak ]
Insurance Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a
uto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv
es over 20,000 policyholders across Ontario.
We will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs
and other personal docs), projects (client personal information and other documents (~250 perso
ns (DL numbers, name, addresses, phones and so on)), contracts and agreements, NDA, etc.
lyserp.com
October 29, 2026
•[ ransomware, technology, leak ]
lyserp.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: www.lyserp.com. ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.
Light Rail Manila
October 30, 2026
•[ ransomware, leak ]
Light Rail Manila was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Transportation. Country: Philippines. Website: www.lrmc.ph.
ArentFox Schiff
October 30, 2026
•[ ransomware, leak ]
ArentFox Schiff was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. ArentFox Schiff LLP is a prominent national law firm and lobbying firm formed on March 1, 2022, throug
Grundbaulabor Trier
October 26, 2026
•[ ransomware, manufacturing, leak ]
Grundbaulabor Trier was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Germany. Website: gbl-trier.de. gbl-trier.de Grundbaulabor Trier is a German geotechnical engineering firm founded in 1960 in Trier by Dr. Paul Lehmann, now run by the third generation of the Lehmann family with 23 qualified engineers. It has completed over 20,000 projects in soil investigation, foundation design, construction supervision, environmental contamination assessment and hydrogeology across Rhineland-Palatinate, Saarland and Luxembourg. The firm operates its own soil mechanics laboratory offering fast and reliable sample processing with modern testing equipment. Led by Managing Directors Eric Lehmann and Bernd Mertes, it is one of the leading geotechnical bureaus in the Trier-Saarbrcken-Luxembourg region.
quevedo-ponce.com
October 31, 2026
•[ ransomware, leak ]
quevedo-ponce.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Ecuador. Website: quevedo-ponce.com. Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuador
Gamdom V2
October 31, 2026
•[ ransomware, technology, leak ]
Gamdom V2 was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. An Insight into Gamdom's Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
- The 15.4 million entries will be leaked in the same format as below.
- The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
- All support chats and photos shared in the support chat are in my possession; see the samples below.
- The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER Founder
- Admin uid 16259643 "Felix aka Howly" last IP 13.250.207.55 (Aug 19) net +859,966,343 sats
- Legacy supadm uid 3356423 - PHONE +49175804570
- Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down.
5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)
October 31, 2026
•[ ransomware, leak, government ]
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Government & Defense. Country: Germany. SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) is a state-owned land development company belonging to the German federal state of Saxony-Anhalt. The organization specializes in urban and regional planning, brownfield redevelopment, land resource management, and the support of infrastructure projects. It operates as a service partner for local municipalities, coordinating and implementing spatial development programs in the interests of the public sector.
Italtel Peru
September 1, 2026
•[ ransomware, technology, leak ]
Italtel Peru was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Peru. [AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market.
transportesmontejo.com
September 1, 2026
•[ ransomware, leak ]
transportesmontejo.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Transportation. Country: Mexico. Website: transportesmontejo.com. Transportes Montejo S.A.S. is a Colombian specialized heavy transport and logistics company established on June 7, 1988,...
REXT Holdings Co., Ltd.
September 1, 2026
•[ ransomware, retail, leak ]
REXT Holdings Co., Ltd. was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Japan. Website: www.rext.jp. Private retail and holding company based in Tokyo, Japan.
