-
Cybercrime group WHITEARMOR says it took Hisense customer records and warranty claim files linked to Malaysia and Singapore.
-
The group claims the files include details on 2,549 suppliers, plus invoices, payment details, and contracts.
-
Nobody has confirmed the break-in, and reports give two different ransom figures, $5 million and $500,000.
A cybercrime group called WHITEARMOR says it broke into the systems of Hisense. The group claims it took 19 GB of data from the electronics maker. The files allegedly come from the customer relationship management records of Hisense. They also come from warranty claims archives linked to Malaysia and Singapore.
Monitoring platforms logged the claim on October 25, 2026. According to reports, these platforms rely on public threat intelligence. Nobody has independently confirmed the break-in so far. Details about the data come only from the claims of the group itself.
WHITEARMOR Says It Took 19 GB from Hisense Systems
WHITEARMOR says the data came from the GCRM production repository of Hisense. The group also names the warranty claims archives for Malaysia and Singapore. It puts the total size at 19 GB.
Security monitoring platforms recorded the claim on October 25, 2026. A separate report described the same claim on that date. All of these reports lean on public threat intelligence. None of them proved that the intrusion happened.
According to WHITEARMOR, the files hold customer names, phone numbers, and email addresses. They also hold identification numbers. The group says it has records on 2,549 suppliers.
The list does not stop there. WHITEARMOR also claims it has invoices, payment details, and contracts. It mentions return merchandise authorisation forms, which are papers for product returns. It also lists proof used in warranty claims. Finally, the group says it holds an internal CRM application file.
Every detail above comes from information attributed to the group. Monitoring platforms simply passed the claim along. That makes the list of stolen items an allegation, not a proven fact.
If the files are real, the risks could be serious. Scammers could use customer details to send targeted phishing messages. Supplier records and business papers could reveal private deals between companies. For now, nobody has confirmed that the data is real or complete.
Reports Give Two Different Ransom Amounts
The reported ransom demand changes from one report to the next. One report says WHITEARMOR asked for $5 million in Bitcoin. The same report says the group threatened to publish the data on November 24, 2026. That threat applies if Hisense refuses to pay.
Other reports name a smaller sum. They say the group wants $500,000 in Bitcoin. That is ten times less than the first figure. The available reporting does not explain the gap. The ransom amount therefore stays disputed. The deadline sits about one month after the claim first appeared. WHITEARMOR set that date itself. The reports do not show any reply from Hisense to that deadline.
The reports leave other basic questions open. They do not say whether the attackers locked any systems. They do not say whether Hisense lost any working time. They also do not say whether the attackers kept access to the network. No verified evidence shows that the group really got the files it describes.
One monitoring platform lists the case as a claimed attack. It does not call it a confirmed breach. Several platforms carried the claim, so it clearly spread in public. Still, that spread does not prove the break-in took place.
Impact on Customers and Suppliers Stays Unclear
If the records are real, customers and suppliers could face new dangers. Criminals could pretend to be someone else. They could send fake payment requests. They could also write phishing messages that look honest. Invoices, contracts, and warranty papers give them details that make such messages more believable.
In a separate incident, a hacker gained access to a US defense supplier through a phishing attack, highlighting how phishing can threaten organizations across different industries.
Even so, the claimed size of the leak is not a list of victims. The sources do not say how many customers the files touch. They do not say whether the payment details include sensitive financial information. They also do not say whether anyone has checked the files.
As of October 26, 2026, the reviewed sources held no confirmation from Hisense. The company has not shared an independently verified statement about the claim. That does not prove Hisense has stayed quiet elsewhere. It also does not prove an investigation is missing.
Proof would change the picture quickly. A statement from Hisense could confirm or reject the claim. Independent experts could check the files to see whether they are genuine. None of these steps has appeared in the sources so far.
The November 24 date and the ransom demand come from the group itself. They form part of its claimed ultimatum. They do not prove that the data will go public.
The case remains a developing cybersecurity claim. More evidence will decide what happens next. Confirmation of the breach, the truth of the files, and the real ransom amount all depend on it. Reliable updates from Hisense or independent investigators will also matter. Until then, readers should treat every detail as an allegation.
