A new extortion group calling itself WhiteArmor claims it stole 19GB of data from Hisense and is demanding $5 million in Bitcoin, according to reporting on October 26. Hisense has not confirmed the claim, and the group’s assertions are unverified.
WhiteArmor’s Leak Site Listing and Ransom Countdown
WhiteArmor lists six victims on its leak site. The Hisense posting carries a countdown of more than 28 days and a demand of $5,000,000 in Bitcoin. Posts on X suggest the demand rose from $500,000.
A 348KB Sample That Could Not Be Opened
The group released a 348KB sample, but it was inaccessible at the time of writing because the hosting server was not responding. Hisense was asked for comment and no Hisense statement has been published.
Claimed Contents: Malaysia and Singapore Warranty Operations
The group says the data includes the GCRM production document store and the full warranty-claims archive for Malaysia and Singapore. According to the claim, the material contains customer names, phone numbers, email addresses and ID numbers, along with 2,549 suppliers, hundreds of invoices, payment records, contracts, RMA forms and claim evidence. WhiteArmor also says it holds the internal CRM application binary.
Aras Nazarovas Assesses Limited Impact if the WhiteArmor Claim Holds
Security researcher Aras Nazarovas said that if the claim is true, the impact appears limited to Malaysia and Singapore warranty claims and mostly involves the confidentiality of customer personal information. He added that the CRM binary could be reverse-engineered, which could enable return fraud.
A Different Spelling From the Earlier Disney Claim
Reporting notes that a group named “WhiteArmour” claimed a Disney staff directory in coverage from October 22. The reporting spells this group “WhiteArmor,” and the reports do not establish that the two names refer to the same group.
Hisense Has Not Confirmed the WhiteArmor Claim
None of the group’s assertions have been independently verified. No Hisense statement exists, the sample is unavailable, and the data volume and contents come only from the leak-site listing. The listing’s countdown and the reported change in the ransom figure are the only details of the group’s conduct available.
The claim covers warranty operations in two markets of the Chinese electronics maker rather than its global business, and any confirmation would need to come from Hisense or from independent review of the data the group has said it holds.
What Is Known and Unknown About the Hisense Listing
Little about the claim can be checked. The leak-site listing is the source for the 19GB figure, the $5,000,000 Bitcoin demand and the countdown of more than 28 days. The only independent detail is that reporters saw the listing and found the sample inaccessible.
The claimed material is broad. It includes the GCRM production document store, the full warranty-claims archive for Malaysia and Singapore, customer names, phone numbers, email addresses and ID numbers, and 2,549 suppliers. It also includes hundreds of invoices, payment records, contracts, RMA forms and claim evidence, plus the internal CRM application binary.
If the claim is accurate, personal data and supplier information for two markets would be at risk. Nazarovas’s assessment that the impact is limited to Malaysia and Singapore warranty claims depends on the claim being true as described. His point about the CRM binary is that reverse-engineering it could support return fraud.
WhiteArmor is described as a new extortion group with six victims on its leak site. The change in the demand from a reported $500,000 to $5 million comes from posts on X, which suggest the figure rose. Hisense had been asked for comment at the time of reporting, and the company had not issued a statement.
The October 26 listing is the only dated event in the available reporting.
