SOME
October 26, 2026
•[ ransomware, technology, manufacturing ]
SOME was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Country: Italy. Website: some.it. some.it SOME Srl is an Italian ERP and financial systems consulting company founded in 2001 in Milan, delivering end-to-end implementations of Epicor Kinetic, Infor SunSystems and Fluentis ERP for manufacturing, hospitality and oil and gas clients. With about 22 employees and revenue of 2.8 million euro, it has completed over 100 implementations across Europe, the Americas and North Africa. The company operates both as a system designer building ERP architectures and as a local specialist adapting global models to Italian fiscal and regulatory requirements. Led by Sales Director Franco Giannini and Partner Hussein Bahobeshi with 25 years of hospitality ERP expertise, it serves international hotel chains, oil companies like Mellitah and ENI Congo, and mid-size manufacturers.
SAP
October 26, 2026
•[ ransomware, technology ]
SAP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: Germany. Website: sap.com. sap.com SAP Latin America and Caribbean is the regional arm of SAP SE, the world's largest enterprise software company, managing operations across 10 countries with about 6,000 employees led by President Adriana Aroulho since April 2025. Brazil is the standout market, cited in 40 straight quarters of global earnings for exceptional cloud revenue growth and now having more customers running on cloud than on-premise. The region serves over 5,000 clients in Brazil alone and holds 50 percent share among large Brazilian enterprises, with major wins including Grupo Nutresa, Honda South America, Votorantim, Chedraui and Motta Internacional. Through RISE with SAP and GROW with SAP, the company drives cloud ERP migration and Business AI adoption with its Joule assistant, targeting up to 30 percent productivity gains for clients. SAP's global cloud revenue reached 6.7 billion euro in Q3 2026 with the LatAm cloud market projected to double to 125 billion dollars by 2030.
WABAG
October 26, 2026
•[ ransomware, energy, technology ]
WABAG was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Energy & Utilities. Country: India. Website: wabag.in. wabag.in VA Tech WABAG is the world's leading pure-play water technology company, founded in 1924 and headquartered in Chennai, India, operating in over 25 countries with 2000 engineers and over 1500 plants delivered. Listed on NSE and BSE, it posted record FY2026 revenue of 3944 crore rupees with PAT of 371 crore and has been net cash positive for 6 straight years with a credit rating of AA minus stable. Its order book surged to an all time high of 19400 crore rupees in Q1 FY2027, over 4 times annual revenue, backed by World Bank, ADB and JICA funded projects across India, the Middle East, Africa and Southeast Asia. Key projects include Southeast Asia's largest 400 MLD desalination plant in Chennai and a 300 MLD mega desalination order in Saudi Arabia. The company holds 125 plus proprietary patents and ranks 3rd globally among private water operators and desalination suppliers per Global Water Intelligence. Led by Chairman Rajiv Mittal.
StarImage
October 26, 2026
•[ ransomware, healthcare, technology ]
StarImage was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: United States of America. Website: starimagesouthlake.com. starimagesouthlake.com StarImage Dental Boutique & Oral Surgery is a premium dental practice in Southlake, Texas, opened in January 2021 as the second location of StarImage Dentistry founded by Dr. James Green in Wichita Falls over 25 years ago. Led by Dr. Green, oral surgeon Dr. Dustin Van Tassell and Dr. Susan Millner, it offers cosmetic and reconstructive dentistry, dental implants, full mouth rehabilitation, oral surgery, TMJ treatment and sleep apnea care all under one roof. The clinic is one of the most technologically advanced dental offices in the US, equipped with Planmeca ProMax 3D CBCT imaging, MLS laser therapy, VELscope cancer screening and CT-guided implant surgery. Both lead doctors hold Fellow status at the Las Vegas Institute for Advanced Dental Studies, and the practice maintains a perfect 5.0 rating across 50 plus reviews. Its dedicated TMJ and Sleep Center provides a high-margin specialization in jaw disorders and obstructive sleep apnea.
Pac Production
October 26, 2026
•[ ransomware, energy, technology ]
Pac Production was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Sweden. Website: pac.se. pac.se PAC Group is a Swedish power plant automation company founded in 1979 in Stockholm, delivering control systems, simulation and optimization solutions for thermal, hydro, nuclear and renewable power plants. It has completed over 600 projects on more than 100 power plants across 50 countries with a combined capacity exceeding 110 gigawatts. Its product portfolio includes PAC Control, PAC-Sim full scope simulators, PAC-Balance and the ARTOCloud optimization platform, plus engineering, commissioning and cybersecurity services. The company is independent from major DCS vendors like Siemens and Emerson, giving it flexibility to integrate any technology. Led by CEO Mikael Andersson, many engineers have been with PAC for 20 to 34 years, ensuring deep institutional expertise. New directions include hydrogen power plants, battery energy storage, hybrid plant control and digital twin solutions.
smithandcasady.com
October 15, 2026
•[ ransomware, manufacturing, energy ]
smithandcasady.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: United States of America. Website: smithandcasady.com. Inside: a subcontract agreement and insurance requirements from general contractor Charles Perry Partners, Inc. (CPPI, Gainesville); commercial invoices for the export of insulation materials to the U.S. Virgin Islands (HOVENSA LLC, oil refinery, Christiansted); cost estimate sheets for FOAMGLAS, Armaflex, and aluminum jacketing covering dozens of projects from Tampa to Hollywood; bid proposals for the insulation of a Raytheon PCS classified facility, "Classified NE Operations A"; correspondence on the Raymond James Stadium project with Manhattan Construction and BCH Mechanical a dispute ove
Gamdom V2
October 31, 2026
•[ ransomware, technology, leak ]
Gamdom V2 was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. An Insight into Gamdom's Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
- The 15.4 million entries will be leaked in the same format as below.
- The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
- All support chats and photos shared in the support chat are in my possession; see the samples below.
- The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER Founder
- Admin uid 16259643 "Felix aka Howly" last IP 13.250.207.55 (Aug 19) net +859,966,343 sats
- Legacy supadm uid 3356423 - PHONE +49175804570
- Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down.
5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
Italtel Peru
September 1, 2026
•[ ransomware, technology, leak ]
Italtel Peru was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Peru. [AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market.
Rise UP
September 1, 2026
•[ ransomware, technology ]
Rise UP was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Website: riseup.ai.
meccahighfeed.blogspot.com
September 1, 2026
•[ ransomware, manufacturing, technology ]
meccahighfeed.blogspot.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Agriculture and Food Production. Country: Saudi Arabia. Website: meccahighfeed.blogspot.com. (Mecca High Feed Factory) is an Egyptian animal feed manufacturing compan...
Algra Group
August 14, 2026
•[ ransomware, technology, manufacturing ]
Algra Group was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Other. Country: Switzerland. Website: algragroup.ch. Algra Group specializes in customized input systems, front panels, and industrial labels, provi
ding tailored solutions for various industries. Their product range includes agnostic touch sys
tems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation,
wellness, medical technology, and transportation.
We will upload corporate data soon. Employee personal information (passport numbers, DLs), clie
nts and partners information, contacts and agreements, financials, NDAs.
Quality Resource Pvt
September 1, 2026
•[ ransomware, technology, leak ]
Quality Resource Pvt was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: United States of America. Website: qualityresourcepvt.com. Country: United States |
Website: qualityresourcepvt.com |
Revenue: $19 Million |
Industry: Advertising Networks |
Employees: 201500 employees |
Properties: 60.1 GB (170,436 Files, 88,440 Folders)
SITES Medical
September 1, 2026
•[ ransomware, healthcare, manufacturing ]
SITES Medical was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Healthcare. Country: United States of America. Website: sitesmedical.com. SITES Medical is a trusted partner for orthopedic implant companies, offering innovative orthopedic technologies and a rapid product concept-to-launch process. They provide comprehensive R&D services, including regulatory filings, and contract manufacturing capabilities to ensure high-quality products at reduced costs. Their expertise spans various markets, including orthopedic, spine, dental, and more, with a focus on enhancing product offerings through advanced technologies like OsteoSync Ti. SITES Medical collaborates closely with clients to integrate these technologies into their product lines, supporting their success in the competitive medical market.
The company headquarters is located in 4707 East Park 30 Drive, Columbia City, IN 46725, United States.
11-50 Employees
SCHMIDT
September 1, 2026
•[ ransomware, leak, manufacturing ]
SCHMIDT was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-09-01. Country: United States of America. Website: schmidtmfg.com. Abrasive Blasting Systems and Engineering Solutions for Industry.
Flex1
September 1, 2026
•[ ransomware, technology, financial ]
Flex1 was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-01. Flex1 is an innovative provider of desktop-as-a-service solutions that enables businesses to cr
eate secure and cost-effective digital workspaces. Their platform combines cloud architecture w
ith productivity tools and managed support services to ensure employees can work efficiently fr
om any device, at any time.
We will upload 402gb of corporate data and their client soon. Employee personal information, cl
ients information (lawyers clients (passports, DLs, SSNs and so on), pet's clinic, etc), financ
ials and so on.
iwin
August 28, 2026
•[ ransomware, manufacturing, technology ]
iwin was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2026-08-28. Sector: Technology. Country: South Korea. Website: www.iwin.kr. This company is a manufacturer of car parts. We have obtained all of your company's technical data. (1TByte) If you do not contact us, all your data, including technical, sales, drawings, quality, logistics, and supply chain information, will be leaked.
Oportunidados
September 1, 2026
•[ ransomware, technology ]
Oportunidados was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-09-01. Country: Brazil. Website: oportunidados.com.br. Business Services
Macquarrie
September 1, 2026
•[ ransomware, technology, manufacturing ]
Macquarrie was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Financial Services. Country: Australia. Website: macquarrie.com.au. Macquarrie specializes in diesel engine management solutions, telemetry solutions, and VK debarkers for milling operations. With over 70 years of experience, they provide a comprehensive range of products including controllers, displays, and monitoring instrumentation tailored for various industries such as mining, agriculture, and marine. The company prides itself on customer-focused service, offering local technical support, extensive after-sales assistance, and expert software programming. As the exclusive Australian agents for Valon Kone Oy, Macquarrie is recognized for its expertise in debarking solutions for sawmills.
The company headquarters is located in Unit 1/600 Lorimer Street, Port Melbourne, VIC 3207, Australia.
11-50 Employees
part1.simplexengg.in
September 2, 2026
•[ ransomware, technology ]
part1.simplexengg.in was listed as a victim on the leak site of the Eclipse ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Technology. Country: India. Website: part1.simplexengg.in.
Star Aviation, Inc
September 2, 2026
•[ ransomware, manufacturing, technology ]
Star Aviation, Inc was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Transportation. Country: United States of America. Star Aviation, Inc. is a leading provider of engine wire harness repair services, including DER repairs and PMA, specifically tailored for the Commercial Aerospace Industry. They offer a comprehensive range of services such as wire harness inspection, testing, repair, overhaul, modification, and sales. The company is committed to enhancing reliability and reducing maintenance costs for their clients by utilizing advanced technology and a customer-focused approach. Star Aviation is recognized as the world's first full-service Electronic Wire Interconnect System (EWIS) Solution Center, ensuring high standards of quality, safety, and customer service.
The company headquarters is located in 9001 W Highway 42, Goshen, KY 40026, United States.. 11-50 Employees
