Unilever is a British multinational consumer goods company headquartered in London. It owns over 400 brands, including Dove, Knorr, Hellmann's, and Rexona, spanning beauty, personal care, home care, and foods, serving consumers in around 190 countries worldwide.
We hold 665K contacts, 5.5K OTM accounts with roles and logins, 14M locations, 3.8M shipments, 229M status records, 13.8K invoices, plus 838K distributor loyalty profiles and ledgers. 79 gigabytes, 1.8 million files, three regions.
Unilever7.z is about 79GB decompressed.
Our ransom demand is only $15,000,000 in BTC
Emails with instructions will be sent to you shortly, if you have failed to receive them,
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Project Trojan Horse
DM us to sell your IA on $/%, working with all kinds of accesses depending on said target.
Rules :
- No companies under $500kk
- No companies in the CIS conglomerate
- Okta, Azure, IAM Root, CRM tools , Jenkins & VPN access (Forti, Anyconnect, Citrix, Sonicwall)
We are also recruiting employees/insiders at various companies!
If you work at a company in the following sectors, please inquire us :
- Education (Technology/Software, EdTech platforms, K-12 Management)
- Software (Entreprise-grade, CRM, SaaS, HR Software, CyberSec, Productivity)
- Insurance (Globally)
- Hotels (Worldwide hotel groups, operators, luxury)
- Telecommunications (Major global telecommunication companies)
- Finance (Banking, Private equity, fintech)
- Retail (Global retailers, supermarkets, fashion, electronics, furniture, luxury)
- Motor (Car manufacturers, Luxury automotive brands, etc.)
- Transportation (Aviation, Shipping, Railways/Public transportation, Mobility)
- Logistics (Supply chain, global companies)
Please only inquiry us if you work/have access to companies that are med/largely sized from these industries/sectors.
You will be paid if you like depending on what you have; Contact us in order to discuss about rates (%) based deals or $ ones. Escrow is always accepted.
t.me/whitearmorsupp / @whitearmorsupp on Telegram.
"Every collectivist revolution rides in on a Trojan horse of EMERGENCY." - Herbert Hoover (1952). “Memoirs: The great depression, 1929-1941”
Gamdom V2
An Insight into Gamdom's Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
- The 15.4 million entries will be leaked in the same format as below.
- The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
- All support chats and photos shared in the support chat are in my possession; see the samples below.
- The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER — Founder
- Admin uid 16259643 "Felix aka Howly" · last IP 13.250.207.55 (Aug 19) · net +859,966,343 sats
- Legacy supadm uid 3356423 - PHONE +49175804570
- Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down.
5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
KTU Shipyard
Company: PT Karya Teknik Utama (KTU Shipyard)
Location: Batam, Indonesia
Founded: 1982
Industry: Shipbuilding & Marine Engineering
Website: https://ktushipyard.com/
What the company does
KTU Shipyard is an Indonesian shipbuilding company specializing in the construction, repair and maintenance of commercial vessels.
Its main products and services include:
- Tugboats
- Barges
- Tankers and cargo vessels
- Crane barges
- Ship repair and maintenance
Company size
- Privately owned company.
- Approximately 501–1,000 employees.
- Multiple shipyard facilities in Indonesia.
- Claims to have built approximately 2,200 vessels.
Annual Revenue
~USD 200 million
Key Business Information
- Business model: B2B shipbuilding and marine services.
- Customers: Shipping companies, marine logistics operators and offshore businesses.
- Main market: Indonesia and regional maritime markets.
- Competitive advantage: Established shipbuilding experience, multiple facilities and diverse vessel manufacturing capabilities.
What was accessed: Internal ticketing systems, All users drive (including business, customer, confidential files over 3tb of data), customer data, etc. You have 20 days to reach out or let it be your downfall.
Attatched: Is a sample file from recent user drives, and a screenshot showing POA (proof of access)
We can be very reasonable and this can go well or it can not. You can start contact at the email: whitearmormember@proton.me
https://gofile.io/d/G981x5Rl
https://gofile.io/d/99sTtibR
(backup sample files)
rolly.io
Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus formulas (rakeback, weekly bonuses), and active player reward systems.
We hold 1,364 rolly.gg player PII records with linked on-chain wallets, 430K+ ledger transactions, 11,442 wallet addresses, 155 whale payout maps, 299 deanonymized staff/CTO emails, and 313 internal chat messages.
We aren't asking for any ransom, we just thought it was funny to hack a casino that made a joke about Gamdom.
Ryder
Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions.
What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT.
Our demand is only $20M in BTC... i swear.
Samples can be found below.
Emails with instructions will be sent to Ryder shortly, and no we did not buy access from 'shadowbyte' or whatever the niggas name is on pwnforums.
Contact if you do not receive the instructions:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
wagyu.xyz unfairness
wagyu.xyz runs two rigged systems, both proven by the evidence:
1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).
2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).
Evidence to support this can be found below:
Echo.com
Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America.
We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata.
We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives.
Emails with instructions will be sent to you shortly.
Samples can be found below.
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
https://t.me/whitearmorxd
Hi, join our telegram channel for fun.. i guess
https://t.me/whitearmorxd
Kucoin
Dear Kucoin,
We are NOT a hacktivist group. We focus mainly on data extortion & ransomware, so please fuck off with your hacktivist bullshit.
https://www.kucoin.com/news/flash/hacktivist-group-whitearmor-claims-to-steal-15-42-million-gamdom-accounts-demands-15m-in-bitcoin
wagyu.xyz
Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid's order book for execution .
We hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume.
Our demand is only $5,000,000... hehe
Samples can be found below.
Since you do not have any emails for us to contact, surely you will contact us yourselves.
Contact Us:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
gamblinglore
Verification for Gamblinglore.com
Gamdom
Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million.
We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion.
The way in was something internal, a machine account that was already sitting in their admin side (Metawin).
Issued years back, nobody ever rotated it. Never meant to leave the building.
It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores.
About your provably fair: what it promised and what it delivered were never the same thing.
We demand $15,000,000 in BTC.
Emails with instructions will be sent to you directly.
To verify, a sample can be found below.
LoveSac
LoveSac (LOVE) is a premium furniture retailer operating more than 250 showrooms across the United States, generating approximately $700 million in annual revenue.
We have obtained a database containing 1,113,285 order records spanning nearly seven years of transactions, from December 2019 through October 2026, with a combined recorded transaction value exceeding $1.62 billion.
Each record contains detailed customer and transaction information, including full customer names, complete billing and shipping addresses, telephone numbers, order numbers, order dates, order statuses, and order grand totals.
Our demand: $500,000 in BTC or XMR
To verify, samples can be found below.
WhiteArmor.cc
Hi, our VPS provider has decided to ban our account. Due to this, whitearmor.cc is down and so is most of the data posted on our DLS.
Everything will be back up within a day or two. One tip, do NOT use https://stealthvm.net/ XD
J.B Hunt
You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords..
Fuck you... ;/
https://x.com/WhiteArmorxd
Hi, we now have an X account.
https://x.com/WhiteArmorxd
Also, fuck the AI slop cti reporters lol
Partido Liberal
Brazil's Liberal Party (PL) is the political party of the Bolsonaro family. Although named "Liberal," it is currently characterized by conservatism and right-wing populism. Jair Bolsonaro joined the party in 2021, and his son Flávio Bolsonaro is now the party's presidential candidate, advocating reduced government intervention and tough security policies.
We hold the complete Partido Liberal (PL, Brazil) dump: 79K member records with CPF/voter ID/RG photos, 374 live cleartext e-Título credentials, 475 operator accounts with shared password, 2.7M audit events, party dossiers (artist payments, deepfakes, ghost donations), vendor PII, and 340K+ member images.
If you don't want this getting out, we suggest you contact us & pay the ransom amount of $5,000,000 in BTC :)
Contact:
Email: whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Hisense
Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances.
We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary.
Our demand is $500,000 in BTC. Good luck.
Contact: whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
whitearmor.cc
Hi!
We now have a clearnet domain for easy-access.
WhiteArmor.cc
JB Hunt
J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace.
We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations.
Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email.
To verify, samples can be found below.
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Whirlpool
Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion.
We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public.
We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed.
Samples:
https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip
Contact:
whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
W.A
Hello,
We are WhiteArmor, an organization focused on data-theft extortion, with further motive to expand in to ransomware operations when considered big enough.
We are currently seeking the following people of roles and experiences:
Penetration testers
Web-exploitation
Zero-day research
A word due; if you are unfamiliar with the experiences slash roles listed above, do not consider attempting to join. Should you attempt to contact us and join, you will be blocked.
Our fee if you hit a successful ransom payout is 5%. The rest is yours.
Our contacts are available on our DLS below;
http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion/
Updates.
Hi all; spots within the group are still open. If you're looking to join, you can find our contact information at the top right. Our ransomware is nearly complete, and we have multiple companies lined up to list, including Fortune 500 companies and multi-billion-dollar revenue firms.
To be clear, we're not just some random skid group. We are releasing Disney's Staff Directory as a little start to our group, though more to come. Anyways, enjoy.
This data is unrelated to the NullBulge leak; it was exfiltrated via a JWT authentication bypass vulnerability in the gateway.
