telecommunications services · Malaysia
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
Phoenix Charter Academy
Phoenix Charter Academy Network is a public charter school network in Massachusetts, USA, operating three campuses (Chelsea, Lawrence, Springfield) and serving mainly low-income and immigrant families.36,829 files, 445.1 GB of data.Domain controller (password hashes of ~170+ staff accounts)File server, helpdesk server, print serverPowerSchool test server � the student databaseStudent special-education records of named minors: signed IEP/504 plans for the 2025�2026 school year, BASC-3 psychological protocols, three-year re-evaluations, speech-therapy files, discipline recordsImmigration records of students’ families: official CBP I-94 entry records, parole application statements, immigration cover lettersStaff personal and financial data: W-2 forms with SSNs and salaries, US passport card and foreign passport scans, bank statements with account numbers (Bank of America / Tremont Credit Union), signed direct deposit authorizations, CORI background-check filesMedical data: MassHealth cards and applications, immunization recordsMunicipal compliance files: Lawrence Board of Health licenses and inspections (2022�2024), Fire Department inspection certificatesInternal HR material: network-wide salary bands
More
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
AUDIT ID: 1B693EF65DE3E672 / DISCOVERY DATE: 2026-10-23
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
AUDIT ID: 17BACA24A3932895 / DISCOVERY DATE: 2026-10-31
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
AUDIT ID: 1E2CF5D71F581238 / DISCOVERY DATE: 2026-10-31
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
AUDIT ID: 2AE3CE243E823521 / DISCOVERY DATE: 2026-10-31
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
AUDIT ID: 57FD7689754A6F21 / DISCOVERY DATE: 2026-10-31
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
An Insight into Gamdom’s Lies
We have given Gamdom multiple chances to communicate, to no avail. They didn’t even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean?
– The 15.4 million entries will be leaked in the same format as below.
– The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format.
– All support chats and photos shared in the support chat are in my possession; see the samples below.
– The lies within Gamdom’s Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence).
A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case.
FELIX ROEMER — Founder
– Admin uid 16259643 “Felix aka Howly” · last IP 13.250.207.55 (Aug 19) · net +859,966,343 sats
– Legacy supadm uid 3356423 – PHONE +49175804570
– Personal player uid 48242366 (“Felix Roemer”, duel4rs@gmail.com, same phone)
+49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior.
PF:
What their own code actually shows:
1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom’s crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet.
2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out.
3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later.
4. For roulette and hilo, their own code comment admits the result mapping is “slightly biased because of modulo.” They knew and wrote it down.
5. For dice, the player’s seed is never saved to the database, so the “verify your result” feature cannot actually be used after the round.
6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table.
TL;DR: The help page promises “the server seed is secret until reveal, nobody, the house included, can know your next result”. Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps.
The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026.
Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti
Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification.
Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+
This is your last chance to reach out to us, Gamdom.
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
Holcim is a global building-materials and building-solutions company founded in Switzerland in 1912. It provides cement, aggregates, ready-mix concrete and high-value building solutions for infrastructure, buildings and industrial applications. Holcim focuses on sustainable construction through solutions such as ECOPact, ECOPlanet and ECOCycle. In 2025, the company generated CHF 15.7 billion in net sales and operated across 43 markets.
Publication scheduled: 2026-11-14 09:31:56 UTC
Size: 364.2 GB
Sectors: Manufacturing, Construction
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-10-31
Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuador …
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: ransomware.live — Recent Victims · 2026-10-31