Back to Feed
VulnerabilitiesJul 17, 2026

Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man

Armenia detains Russian tourist mistakenly identified as REvil ransomware operator Aleksandr Ermakov.

Armenian authorities detained Aleksandr Yuryevich Ermakov, a Russian tourist, on June 28 based on a U.S. extradition warrant intended for Aleksandr Gennadievich Ermakov, a sanctioned REvil ransomware operator linked to the Medibank breach. Ermakov's lawyers claim U.S. authorities confused the two men due to missing patronymic information in official documentation, and argue standard verification methods like fingerprints or full passport data were never used. The detained man is a former prison-service lawyer from Omsk who does not speak English and is being held on a 30-day Interpol detention order.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run Medibank?

Get an email when a new story names Medibank, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

U.S. authorities issued an extradition warrant using incomplete identity information — omitting the patronymic name — resulting in Armenian authorities detaining an innocent Russian citizen who shares a similar name with a sanctioned REvil ransomware operator. This failure highlights the critical importance of using multi-factor identity verification (biometrics, full legal name, passport numbers, fingerprints) in legal and law enforcement processes, not just partial name matches. The mistake not only violates the rights of an innocent individual but also risks allowing the actual suspect to evade justice. Identity data integrity in law enforcement documentation is a form of data governance that, when neglected, has real-world consequences for civil liberties and operational effectiveness.

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

  • malware — REvil/Sodinokibi

Entities

Aleksandr Gennadievich Ermakov (threat_actor)REvil/Sodinokibi operators (threat_actor)Operation Aquila (campaign)Medibank Private (product)Medibank (vendor)