Loading story…
Travelex was hit by Sodinokibi/REvil ransomware in a New Year’s Eve attack that disrupted its website, mobile app, and card-payment systems across more than 1,500 stores worldwide. The attackers said they had encrypted the company’s network, stolen more than 5GB of files, deleted backups, and demanded $3 million, later escalating pressure by threatening to publish or sell allegedly stolen customer data that they claimed included dates of birth, Social Security numbers, and payment-card information. Travelex acknowledged that some data had been encrypted but said it had no evidence that customer data had been exfiltrated, creating a direct dispute with the gang’s public claims.
Reporting later indicated Travelex likely paid 285 bitcoin—about $2.3 million at the time—to the REvil operators as recovery efforts dragged on for weeks. The incident drew added scrutiny because researchers had previously flagged Travelex’s exposure to insecure internet-facing services, including a potentially unpatched Pulse Secure VPN vulnerable to CVE-2019-11510 and Windows servers exposed without Network Level Authentication, though the exact intrusion path was not confirmed. Travelex did not directly confirm the payment, saying it had worked with external experts while keeping regulators, partners, and U.K. law enforcement informed as services were gradually restored.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
The Wall Street Journal reported that Travelex paid the REvil gang 285 bitcoin, worth about $2.3 million at the time, citing a person with knowledge of the transaction. Travelex declined to directly confirm the payment and said a U.K. law-enforcement investigation was continuing.
Travelex stated that some data encryption had occurred and that it had taken steps to contain the ransomware's spread. The company said it had no evidence that structured personal customer data had been encrypted or that any data had been exfiltrated.
The Sodinokibi/REvil operators told BleepingComputer they had increased their ransom demand from $3 million to $6 million while claiming to be negotiating with Travelex. They also threatened to release or sell allegedly stolen customer data if payment was not made.
Reporting confirmed that Travelex had been infected with Sodinokibi/REvil ransomware. The attackers claimed they encrypted the entire network, stole more than 5GB of personal data, deleted backups, and demanded $3 million while threatening to publish the data within seven days if unpaid.
ComputerWeekly first reported insider information that Travelex had suffered a ransomware attack. This was one of the earliest public reports identifying the nature of the outage.
By the end of January, Travelex began restoring operations and bringing services back online after weeks of disruption. Some systems had remained offline for an extended period following the attack.
Travelex suffered a cyberattack beginning on December 31 that disrupted its website, mobile app, and card-payment capabilities across more than 1,500 stores worldwide. The company took systems offline to contain the incident and prevent the malware from spreading.
A public exploit for Pulse Secure VPN vulnerability CVE-2019-11510 became available, after which attackers began scanning the internet for vulnerable endpoints. The article cites this as part of the threat landscape preceding the Travelex incident.
French authorities released a free decryptor for pyLocky ransomware versions 1 and 2, allowing victims to recover encrypted files without paying. The tool was developed with contributions from the French Ministry of Interior, BEFTI, ST(SI)² of the Gendarmerie nationale, and volunteer researchers.
Pulse Secure patched CVE-2019-11510, a VPN vulnerability that could allow unauthenticated remote access to corporate networks on unpatched systems. The flaw was later discussed as a possible exposure relevant to Travelex's environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
grahamcluley.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
REvil, also known as **Sodinokibi**, abruptly lost its public-facing and backend infrastructure, with its Tor leak and payment sites, clear-web presence, and the `decoder[.]re` domain all going offline at roughly the same time. The disappearance was highly unusual for a group whose infrastructure had been comparatively stable, and it followed REvil’s involvement in several high-profile ransomware incidents, including attacks on **Kaseya** and **JBS Foods**. The outage came amid intense law-enforcement and geopolitical pressure after the Kaseya VSA supply-chain attack, which reportedly impacted about 60 managed service providers and more than 1,500 businesses. Reporting cited several possible explanations, including a government takedown, a legal demand that prompted operators to wipe servers, a voluntary shutdown, technical failure, or a rebranding effort, but no definitive cause was confirmed; researchers also warned that even a successful disruption would not necessarily end the threat, as affiliates could regroup or reappear under a new name.
Aug 15, 2026
The Russia-linked **Evil Corp** cybercrime group repeatedly renamed and modified its ransomware after U.S. Treasury sanctions tied to its **Dridex** operations complicated ransom payments. Researchers and incident reporting linked a progression from **BitPaymer/FriedEx** and **WastedLocker** to **Hades**, **Phoenix Locker**, **PayloadBIN**, and **Macaw Locker**, with analysts citing shared code, tooling, and tradecraft across the families. Security firms said the group also adjusted its operations by leaning on tools such as **SocGholish**, **Cobalt Strike**, and the **CryptOne** packer to blur attribution while continuing enterprise-focused intrusions. The rebrands were tied to major disruptive attacks on large organizations. **Garmin** suffered a global outage in a confirmed **WastedLocker** incident, **Forward Air** disclosed operational disruption from **Hades**, and later **Olympus** and **Sinclair Broadcast Group** were linked to **Macaw Locker**, with Sinclair experiencing broadcast interruptions. Reporting said victims were directed to Tor-based negotiation portals and, in some cases, faced demands as high as **450 bitcoin** or **$40 million**, underscoring how Evil Corp preserved its extortion business despite sanctions pressure.
Aug 15, 2026