The medusalocker ransomware group listed Geetees on its data leak site on 2026-11-04. Domains named: g.twist Claim as published on the leak site: G.Twist (Wholesale) Ltd. wholesales goods, including licensed merchandise such as Harry Potter and Christmas items. The company also tracks orders, inventory, and online sales through payment systems.