Elexon Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 14, 2020, Elexon appeared on a leak site operated by the ransomware group revil. The listing indicated that internal files had been taken during a ransomware operation, though the volume of data, the precise nature of the files, and whether any material was later published remain undisclosed. Public records do not confirm the number of individuals affected or the operational impact on the organisation. This incident occurred at a time when several ransomware operators had begun publishing victim names on dedicated leak sites as a secondary pressure tactic after encryption. Such listings were intended to prompt payment by threatening further disclosure, a pattern observed across multiple sectors in 2019 and 2020.

Inside the incident

The only confirmed public detail is the appearance of Elexon on the revil leak site on the reported date. The group stated that internal data had been removed, but no independent verification of the claim or subsequent release of files has been documented. The number of people affected is recorded as unknown, and no information has been released about the method of initial access, the duration of any unauthorised presence, or whether encryption was also deployed.

The group behind it: revil

Revil, also tracked publicly as Sodinokibi, operated as a ransomware-as-a-service affiliate model during its active period. The group developed and distributed ransomware while allowing other actors to conduct intrusions in exchange for a share of ransom payments. Its operators maintained leak sites where they listed organisations that had declined to pay, publishing samples or full archives in some cases. The group was linked to multiple high-profile incidents before its infrastructure was disrupted in 2021 through coordinated law-enforcement action.

About Elexon

Elexon is the organisation responsible for administering the Balancing and Settlement Code in Great Britain’s electricity market. It processes data related to energy generation, consumption, and financial settlement between market participants. Entities in this sector routinely hold operational records, metering information, and commercial arrangements that support the functioning of national energy infrastructure.

The information in question

The listing described the material only as internal files. No further breakdown of data categories has been made public. Organisations of this type commonly maintain records of market transactions, participant identifiers, and system configuration details, yet the exact contents of any exfiltrated material in this case remain unconfirmed.

Why it matters

Exposure of internal operational files from an energy-market administrator can create secondary risks, including insight into market processes or participant relationships. Where personal or commercial identifiers are involved, affected parties may face increased exposure to targeted fraud or competitive misuse. The absence of confirmed data volumes or categories leaves the scale of any downstream impact difficult to quantify from public sources.

Were you affected?

Individuals or organisations seeking to determine whether their information appeared in known breach datasets can begin by reviewing any direct notifications received from Elexon. Running a free exposure scan of an email address against aggregated breach records provides an additional check for listings that have surfaced publicly. Where specific concerns exist about energy-market data, contacting the organisation directly remains the most direct route for clarification.

AICompiled with AI assistance from public sources and published under our editorial standards.