Ransomware Group Whitearmor Claims Attack on AmplifAI GoDaddy Instance
A newly tracked ransomware group has listed an AI-focused workplace software company on its dark-web extortion site, purportedly offering employee credential data. The company has not confirmed any incident.
Key points
- Whitearmor, a group with no prior track record in incident-response circles, has claimed multiple victims within its first month of activity, all tracked by Threat Vectr's leak-site monitoring.
- The group's post claims to hold data tied to a GoDaddy-hosted instance of AmplifAI, a company that makes AI-powered coaching tools for call-centre staff.
- Ransomware.live first observed the listing on November 1, 2026.
- AmplifAI has not publicly confirmed any breach, and the claim could not be independently verified at publication time.
- Whitearmor has spread its claimed victims across six industries, with Technology companies the most frequent target so far.
A ransomware group calling itself Whitearmor has named AmplifAI, a Texas-based company whose software uses artificial intelligence to coach call-centre workers, on its dark-web extortion site. Ransomware is malicious software that criminals use to lock a company's files or steal its data, then threaten to publish what they took unless a ransom is paid. Leak sites are the public-facing part of that pressure: a page on the dark web where groups list victims by name to embarrass them into paying.
The listing, first flagged on November 1, 2026, targets a GoDaddy-hosted instance of AmplifAI's platform. GoDaddy is a web-hosting company. Large software providers routinely run separate customer environments on shared hosting infrastructure, so a breach of one instance wouldn't automatically mean the wider GoDaddy network was affected.
What does the group claim to have taken?
The group's post claims the alleged data includes an employee database purportedly covering 13,565 users, broken down by role and including login credentials. Those figures come from the criminals' own posting, which is designed to pressure the victim and may be exaggerated or entirely fabricated. Ransomware.live, the monitoring service that observed the listing, doesn't verify the accuracy of what groups publish.
AmplifAI has made no public statement about the listing, and no independent confirmation of any incident exists.
Should AmplifAI customers and staff be worried right now?
Not necessarily, but some basic caution makes sense while the claim is unresolved. Unverified listings like this one are sometimes used by scammers as a hook to run follow-on fraud, so a few precautions are worth taking.
Be suspicious of any email or phone call claiming to be from AmplifAI's security team or from a "breach compensation" service. Those are almost always scams that use the news as cover. If you use the same password for your AmplifAI account anywhere else, change it now at those other sites. Enable two-factor authentication, which requires a second confirmation step beyond a password, on any account where it's available. Keep an eye on your work email address for phishing attempts, meaning fake messages designed to trick you into handing over login details.
A fast-moving group with no long track record
Whitearmor isn't a name that's circulated for years in incident-response circles. The group is new, its claimed victim list is growing fast across six sectors, and that combination makes independent verification of its claims harder than usual. Our coverage of the Helix group's unverified claim against Bay Alarm on 18 October 2026 shows the same pattern: a group listing a high-value target before any confirmation exists.
The honest read here is that we have a very new group with a very convenient list of targets and no track record yet. That warrants attention, not panic.
