DisclosureLens
GLOBALMalwareRansomwareWhitearmorRansom DemandedActor NamedData Leak ThreatenedData PublishedHigh

Gamdom V2

bd_45fa976e092feba4 · schema v1 · pii pii-v2

Severity

High

Discovered

—

Filed

Oct 31, 2026

To disclose

—

Affected

Not disclosed

Confidence

50%
Full breach record for Gamdom V2 →

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Whitearmor on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: OtherDiscovered: 2026-10-31

Source: Ransomware.live

Post text · scraped from the leak site

An Insight into Gamdom's Lies We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean? - The 15.4 million entries will be leaked in the same format as below. - The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format. - All support chats and photos shared in the support chat are in my possession; see the samples below. - The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence). A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case. FELIX ROEMER — Founder - Admin uid 16259643 "Felix aka Howly" · last IP 13.250.207.55 (Aug 19) · net +859,966,343 sats - Legacy supadm uid 3356423 - PHONE +49175804570 - Personal player uid 48242366 ("Felix Roemer", [REDACTED-EMAIL], same phone) +49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior. PF: What their own code actually shows: 1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet. 2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average retu

Incident timeline — mostly unverified

? — ?

Breach window unknown

Oct 31, 2026

Claim posted

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Claim → filing

—

Compliance clock

Not assessable

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

Evidence ladder

Leak-site claimThis record

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.

Source ceiling

  • actor name
  • victim claim
  • ransom/leak status
  • discovery date
  • materiality
  • notification
  • affected count
  • confirmed data types
  • compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this group

whitearmor

18 tracked hereFull profile →