StarImage
October 26, 2026
•[ ransomware, healthcare, technology ]
StarImage was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: United States of America. Website: starimagesouthlake.com. starimagesouthlake.com StarImage Dental Boutique & Oral Surgery is a premium dental practice in Southlake, Texas, opened in January 2021 as the second location of StarImage Dentistry founded by Dr. James Green in Wichita Falls over 25 years ago. Led by Dr. Green, oral surgeon Dr. Dustin Van Tassell and Dr. Susan Millner, it offers cosmetic and reconstructive dentistry, dental implants, full mouth rehabilitation, oral surgery, TMJ treatment and sleep apnea care all under one roof. The clinic is one of the most technologically advanced dental offices in the US, equipped with Planmeca ProMax 3D CBCT imaging, MLS laser therapy, VELscope cancer screening and CT-guided implant surgery. Both lead doctors hold Fellow status at the Las Vegas Institute for Advanced Dental Studies, and the practice maintains a perfect 5.0 rating across 50 plus reviews. Its dedicated TMJ and Sleep Center provides a high-margin specialization in jaw disorders and obstructive sleep apnea.
Surexport
October 26, 2026
•[ ransomware, manufacturing, retail ]
Surexport was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Spain. Website: surexport.es. surexport.es Surexport is the largest independent berry producer in Europe, founded in 1994 in Huelva, Spain, growing strawberries, raspberries, blueberries and blackberries across Spain, Portugal, the Netherlands, Morocco and Kenya. Owned since 2020 by Alantra Private Equity, the group is valued at around 600 million euros with revenue approaching 400 million and over 2500 employees. Its competitive edge is exclusive berry varieties developed with US genetics partner Plant Sciences since 2007, sold under the Doarosa, Berry Sensations and Fruhi brands. Major clients include Tesco, Lidl, Mercadona and Sainsbury's, with 80 percent of revenue from exports to Northern Europe. The company invested 200 million euros in acquisitions and secured a 250 million euro loan in 2025.
Marie Kruses Skole
October 26, 2026
•[ ransomware, education ]
Marie Kruses Skole was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Education. Country: Denmark. Website: mks.dk. mks.dk Marie Kruses Skole is a private school in Farum, Denmark, founded in 1869 by education pioneer Marie Kruse, offering a full track from kindergarten through gymnasium STX to about 1100 students. It is the only free primary school and the only gymnasium in Fures Kommune, employing 107 people and led by rektor Carsten Gade. The school runs 8 gymnasium study lines including Biotek, Mat-Fys, sports, business, super languages and music, plus unique programs like Kruse Elitesport and diving. Revenue in 2024 reached 109.5 million Danish kroner with a 1.4 million profit, backed by 68 percent state subsidy and a stable surplus for 5 straight years. Tuition is 2190 kroner per month with financial aid available, and it attracts over 1100 students on its waiting list. Its key strengths are 157 years of heritage, top national exam results and free admissions independent of municipal student distribution rules.
Pac Production
October 26, 2026
•[ ransomware, energy, technology ]
Pac Production was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Sweden. Website: pac.se. pac.se PAC Group is a Swedish power plant automation company founded in 1979 in Stockholm, delivering control systems, simulation and optimization solutions for thermal, hydro, nuclear and renewable power plants. It has completed over 600 projects on more than 100 power plants across 50 countries with a combined capacity exceeding 110 gigawatts. Its product portfolio includes PAC Control, PAC-Sim full scope simulators, PAC-Balance and the ARTOCloud optimization platform, plus engineering, commissioning and cybersecurity services. The company is independent from major DCS vendors like Siemens and Emerson, giving it flexibility to integrate any technology. Led by CEO Mikael Andersson, many engineers have been with PAC for 20 to 34 years, ensuring deep institutional expertise. New directions include hydrogen power plants, battery energy storage, hybrid plant control and digital twin solutions.
smithandcasady.com
October 15, 2026
•[ ransomware, manufacturing, energy ]
smithandcasady.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: United States of America. Website: smithandcasady.com. Inside: a subcontract agreement and insurance requirements from general contractor Charles Perry Partners, Inc. (CPPI, Gainesville); commercial invoices for the export of insulation materials to the U.S. Virgin Islands (HOVENSA LLC, oil refinery, Christiansted); cost estimate sheets for FOAMGLAS, Armaflex, and aluminum jacketing covering dozens of projects from Tampa to Hollywood; bid proposals for the insulation of a Raytheon PCS classified facility, "Classified NE Operations A"; correspondence on the Raymond James Stadium project with Manhattan Construction and BCH Mechanical a dispute ove
uaa.mx
October 31, 2026
•[ ransomware, education ]
uaa.mx was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: Mexico. Website: uaa.mx. It provides undergraduate and postgraduate education across a broad range of academic disciplines, including engineering, natural sciences, health sciences, social
quevedo-ponce.com
October 31, 2026
•[ ransomware, leak ]
quevedo-ponce.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Ecuador. Website: quevedo-ponce.com. Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuador
Gamdom V2
October 31, 2026
•[ ransomware, technology, leak ]
Gamdom V2 was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. An Insight into Gamdom's Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
- The 15.4 million entries will be leaked in the same format as below.
- The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
- All support chats and photos shared in the support chat are in my possession; see the samples below.
- The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER Founder
- Admin uid 16259643 "Felix aka Howly" last IP 13.250.207.55 (Aug 19) net +859,966,343 sats
- Legacy supadm uid 3356423 - PHONE +49175804570
- Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down.
5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH)
October 31, 2026
•[ ransomware, leak, government ]
SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Government & Defense. Country: Germany. SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) is a state-owned land development company belonging to the German federal state of Saxony-Anhalt. The organization specializes in urban and regional planning, brownfield redevelopment, land resource management, and the support of infrastructure projects. It operates as a service partner for local municipalities, coordinating and implementing spatial development programs in the interests of the public sector.
Straze Garden Center
October 31, 2026
•[ ransomware, retail ]
Straze Garden Center was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Straze Garden Center is a German company operating a garden center and an online store for gardening supplies. The business specializes in selling indoor and outdoor plants, planting materials, soils, fertilizers, and garden tools. It provides on-site retail sales as well as order delivery across Germany.
Italtel Peru
September 1, 2026
•[ ransomware, technology, leak ]
Italtel Peru was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Peru. [AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market.
Rise UP
September 1, 2026
•[ ransomware, technology ]
Rise UP was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Website: riseup.ai.
Lawter
September 1, 2026
•[ ransomware, manufacturing ]
Lawter was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Manufacturing. Country: United States of America. Website: lawter.com. Organization with 150 emails extracted. Domain: lawter.com
transportesmontejo.com
September 1, 2026
•[ ransomware, leak ]
transportesmontejo.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Transportation. Country: Mexico. Website: transportesmontejo.com. Transportes Montejo S.A.S. is a Colombian specialized heavy transport and logistics company established on June 7, 1988,...
meccahighfeed.blogspot.com
September 1, 2026
•[ ransomware, manufacturing, technology ]
meccahighfeed.blogspot.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Agriculture and Food Production. Country: Saudi Arabia. Website: meccahighfeed.blogspot.com. (Mecca High Feed Factory) is an Egyptian animal feed manufacturing compan...
jswlaw.bt
September 1, 2026
•[ ransomware, education ]
jswlaw.bt was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Professional Services. Country: Bhutan. Website: jswlaw.bt. Jigme Singye Wangchuck School of Law (JSW Law) is Bhutan's first and only law school, established by Royal Charter on Fe...
REXT Holdings Co., Ltd.
September 1, 2026
•[ ransomware, retail, leak ]
REXT Holdings Co., Ltd. was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Japan. Website: www.rext.jp. Private retail and holding company based in Tokyo, Japan.
Szechenyi Programiroda Nonprofit Kf
September 1, 2026
•[ ransomware, government ]
Szechenyi Programiroda Nonprofit Kf was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Hungary. Szechenyi Programiroda Nonprofit Kf
Total Education Solutions
September 1, 2026
•[ ransomware, education ]
Total Education Solutions was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Education. Country: United States of America. Website: tesidea.com. TES IDEA provides personalized educational, therapeutic, and developmental solutions that help students, families, and schools achieve better outcomes.
Congressional Iron Works
September 1, 2026
•[ ransomware, manufacturing ]
Congressional Iron Works was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Manufacturing. Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci
al construction industry in the greater Baltimore-Washington area. Established in 2004, the com
pany offers a range of services including estimating, drafting, fabrication, and project manage
ment, focusing on steel and architectural metals components such as structures, stairs, and can
opies.
We will upload 35gb of corporate data soon. Employee personal information (passport numbers, SS
Ns, DLs, financial information, health information), clients information, company financials, p
rojects, NDAs.
