Ransomware group Whitearmor hits Ryder

MEDIUM

·Transportation·US·2026-10-27

Ryder — a transportation target operating in US has been listed by the Whitearmor ransomware group on 2026-10-27. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.

Incident Report

Target Organization	Ryder
Threat Group	Whitearmor
Summary	Ryder, a transportation organization in the United States, was listed by the Whitearmor ransomware group on its leak site on 2026-10-28.
Date of Breach	2026-10-27
Discovery Date	2026-10-28
Region	US
Target Domain	—
Business Sector	Transportation
Severity	MEDIUM

Claim by Whitearmor

Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions. What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT. Our demand is only $20M in BTC... i swear. Samples can be found below. Emails with instructions will be sent to Ryder shortly, and no we did not buy access from 'shadowbyte' or whatever the niggas name is on pwnforums. Contact if you do not receive the instructions: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me

Posted by the Whitearmor threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.

Sources

Leak post (onion / Tor)

tor

http://whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion

Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.

Disclaimer

HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.