Hisense Faces $5 Million Ransom Demand Over Alleged 19GB Data Theft
Hisense Faces $5 Million Ransom Demand Over Alleged 19GB Data Theft
🚨 Breaking News: Hisense, a major Chinese electronics and home appliance manufacturer known for its TVs, is facing a significant data breach. A new ransomware group, WhiteArmor, claims to have stolen 19GB of sensitive data and is demanding $5 million in ransom. The breach has not been officially confirmed yet.
The threat actor has listed Hisense on its data leak site on the dark web, with a countdown timer indicating over 28 days for the company to respond. The post from the WhiteArmor ransomware operator states, “Our demand is $5,000,000 in BTC. Good luck!” 💰
The hackers allege they have acquired Hisense’s entire GCRM production document store, including the full warranty-claims archive for Malaysia/Singapore, which contains customer names, phone numbers, emails, ID numbers, details of 2,549 suppliers, invoices, payments, contracts, RMA forms, claim evidence, and their internal CRM app binary. They have already released a small data sample of 348KB and threaten to disclose the full 19GB archive, which is currently sealed. However, at the time of writing, the sample was inaccessible as the hosting server was unresponsive.
Hisense has yet to confirm the breach, and the leaked sample remains unavailable. Some posts on social media suggest that the attackers have increased their ransom demands from an initial $500,000.
Aras Nazarovas, a security researcher at Cybernews, noted, “If claims are true, the impact is limited to warranty claims for Malaysia/Singapore, together with customer details.” This breach primarily affects the confidentiality of customers’ personally identifiable information (PII), such as names, phone numbers, email addresses, and invoices. The attackers could potentially reverse-engineer the CRM app binary to target Hisense’s warranty claims processing systems with return fraud or to extract additional customer PII.
WhiteArmor is a new data-theft and extortion group that emerged only a few days ago, with its first victim claimed on October 21st, 2026. Currently, its data-leak site lists 6 victims. The operator charges its affiliates only a 5% fee on successful ransom payments. DarkFeed, a cyber threat intelligence platform, has reported that the threat actor is recruiting pentesters, web exploitation experts, and zero-day researchers. However, these claims remain unverified.
For more details, you can read the complete article here: Read full article