# WhiteArmor ransomware/extortion group claims Hisense data theft (19 GB) and demands $5 million in Bitcoin

> Newly emerged extortion group WhiteArmor claims to have stolen 19 GB from Hisense, including Malaysia/Singapore warranty-claims data, customer PII, 2,549 supplier records and the internal CRM application binary, and demands $5 million in Bitcoin. Hisense has not commented and the claim is unverified.

- **Published:** 2026-11-01T05:52:27Z
- **Last reviewed:** 2026-11-01T05:52:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4965
- **ID:** TL-2026-4965
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** WhiteArmor
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WhiteArmor is a newly emerged data-theft and extortion group that runs a Tor leak site and advertises an affiliate programme in which affiliates keep 95% of successful ransom payments and the operators take 5%. Its first tracked victim listing was on 2026-10-21 (Breachsense records 2026-10-22). Six victims were listed when the Hisense claim was reported on 2026-10-27, and Breachsense listed 12 by 2026-10-31. Named victims include KTU Shipyard, Echo Global Logistics, J.B. Hunt Transport Services, Hisense, Whirlpool, KuCoin, Ryder System and Gamdom. Sectors with identifiable victims are logistics, manufacturing, media, financial services and construction. The group reportedly seeks penetration testers, web-exploitation experts and zero-day researchers (unverified recruitment claim).

On 2026-10-26 the group posted Hisense, a Chinese electronics manufacturer, on its leak site with a countdown timer of more than 28 days and a $5,000,000 Bitcoin demand (reportedly raised from $500,000). It claims 19 GB of data: the GCRM production document store; the full Malaysia/Singapore warranty-claims archive; customer names, phone numbers, email addresses and ID numbers; information on 2,549 suppliers; hundreds of invoices, payment records and contracts; return-merchandise (RMA) forms and claim evidence; and the internal CRM application binary. A 348 KB proof sample was released, but the host serving it was unresponsive at the time of reporting. Researcher Aras Nazarovas assessed the impact as limited to Malaysia/Singapore warranty claims plus customer details, mainly PII, and noted that the CRM binary could be reverse-engineered to facilitate return fraud. Hisense has issued no statement and no independent verification exists.

Access method for Hisense is not disclosed. For another victim, Gamdom, press reporting states the group claims 15,420,003 accounts across 146 database columns, demands $15 million in Bitcoin, and published a 437 KB JSON file with 100 sample accounts. The reported access path was an old internal machine account linked to Metawin that had administrative reach, was never rotated and exposed internal control panels and stored secrets. Gamdom's founder disputes the scale of the claim. One source notes a possible connection to a group called 'WhiteArmour' that claimed Disney data on 2026-10-22; this link is unconfirmed. No malware family, encryptor, CVE or technical IOC (IP, hash) has been published for the Hisense claim. The observed activity is data theft and extortion; file encryption is not evidenced.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1583 Acquire Infrastructure

## Sources

- [WhiteArmor ransomware group claims Hisense data theft, demands $5 million](https://teiss.co.uk/news/whitearmor-ransomware-group-claims-hisense-data-theft-demands-5-million-18363)
- [WhiteArmor Gang Claims 19GB Hisense Data Theft, Demands $5 Million](https://dailysecurityreview.com/?p=45009)
- [Hisense faces $5 million ransom demand over alleged 19GB data theft](https://cybernews.com/security/ransomware-operator-claims-hisense-demands-5-million/)
- [WhiteArmor Demands $15M Bitcoin From Gamdom](https://www.gambling.com/news/esports/whitearmor-demands-15m-bitcoin-from-gamdom)
- [Breachsense: WhiteArmor ransomware group profile](https://www.breachsense.com/ransomware-groups/whitearmor/)
- [SOCRadar Ransomware Intelligence: Hisense / WhiteArmor](https://socradar.io/free-tools/ransomware-intelligence/victims/hisense-whitearmor-d29ee754)
- [Malpedia library entry: WhiteArmor ransomware group claims Hisense data theft](https://malpedia.caad.fkie.fraunhofer.de/library/a8fc8ce0-a70b-4b1a-a117-40556f3092c1/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4965