Tycoon accused of stealing data from thousands of OnlyFans users in multi-million pound
Judging by his Instagram feed it is tempting to conclude crime really does pay for cyber-criminal mastermind Pavlo Kharmanskyi.
The muscled Ukrainian’s profile is plastered with snaps of celebrity-drenched resorts in Greece, Thailand, Bali, and the snow-draped Austrian Alps.
But the luxury lifestyle on social media masks a darker truth about Kharmanskyi’s activities that now threatens to ensnare users of one of the world’s most successful adult content websites, OnlyFans.
High Court documents obtained by The Mail on Sunday reveal allegations of a Dark Web conspiracy involving the theft of personal data from potentially hundreds of thousands of OnlyFans users.
It also shines a light on the often secretive network of agents and businesses that manage OnlyFans ‘creators’ and work to encourage subscribers to part with as much of their cash as possible.
Set up in 2016 by businessman Tim Stokely with a £10,000 loan from his father, OnlyFans has become one of the most successful modern British business stories.
Snap happy: Pavlo Kharmanskyi posts his luxury trips on Instagram
It initially banned explicit content – and still features some creators such as fitness coaches, chefs and artists wanting to build up a network of paying subscribers to their video content. But it boomed when its parent firm, Fenix International, was bought by US businessman Leo Radvinsky in 2019.
Overnight, he opened the platform up to pornography, making it a global phenomenon.
Today, the website boasts more than 4 million creators and raked in £5.3 billion from its 377 million subscribers last year.
The platform has even seen established celebrities try to get a slice of its revenue, with pop star Cardi B, pictured inset, among those to have held accounts on the site.
Many of these creators are represented by agencies – firms that help negotiate marketing deals and collaborations, while also managing their fanbases.
It was the trove of customers and, specifically, their data that allegedly proved irresistible for Kharmanskyi and his firm, OnlyMonster.
In the court filings, Kharmanskyi is accused of stealing the data of OnlyFans users from a rival company called Infinni Innovations, which owns a software platform called Infloww.
Infinni, based in Spain, is the largest of a group of so-called customer relationship management companies, firms that help OnlyFans creators and their agencies deal with subscribers as well as collect data that can then be analysed to make their content as lucrative as possible.
It is this trove that Infinni alleges Kharmanskyi and OnlyMonster hacked into in December 2024 after a series of cyber attacks masterminded by the Ukrainian and business partner Danyl Romanov. Infinni says that, after breaking through the company’s security, they reverse-engineered its systems and used ‘crawler’ software, automated bots that scan webpages, to steal huge amounts of confidential fan data.
Infinni claims OnlyMonster stole 400,000 fan profiles or ‘fan notes’, with other data, to poach customers for its own platform.
The court papers reveal incredibly detailed notes kept on fans by Infinni, including one user described as being ‘from the Bay Area, California: 40 years old; single; lives with parents’.
Another user, Bruno, was a ‘veteran of the Navy Seals’ and ‘a jiu jitsu black belt’.
As well as nicknames, locations and birthdays, the notes included subscription and purchase history.
Infinni also said the hackers made off with ‘commercially valuable script data’. Scripts are used by some agencies to make subscribers think they are talking to the creator, usually in the hope that the ‘personal connection’ will entice them to spend more.
The papers go on to describe how Infinni moved to catch Kharmanskyi red-handed in an elaborate sting that involved setting up a fake company which then contacted OnlyMonster.
Kharmanskyi, in the hope of luring the agency as a client, allegedly told it that his firm had ‘cracked Infloww’ – Infinni’s software.
The sting led Infinni to file a claim in the High Court in February, suing Kharmanskyi, Romanov and OnlyMonster for breach of confidence, conspiracy, and misuse of confidential information. It is seeking an injunction to stop further attacks as well as the return or destruction of all the stolen data and compensation for lost profits and investigation costs.
OnlyMonster has denied claims of hacking saying it simply helped agencies move their data from Infinni’s platform to its own as they were frustrated that Infinni refused to give them their data.
The firm also argues the agencies gave OnlyMonster their Infloww passwords so that the data, including fan profiles and scripts, could be transferred.
Kharmanskyi and OnlyMonster are bringing a counterclaim accusing Infinni of being anti-competitive, unlawful and keeping agencies locked into its platform.
In a sign of how lucrative the sector now is, Mr Justice Rajesh Saini warned any injunction that stopped Kharmanskyi’s firm operating risked ‘very serious financial consequences’ on the agencies that had moved to OnlyMonster.Court
Court papers: The court papers reveal incredibly detailed notes kept on fans by Infinni
It is not the first time Kharmanskyi has been accused of cybercrime. In 2019, he was arrested at Miami Airport for his role in a conspiracy linked to a website called xDedic Marketplace, which he administered and which sold access to hacked corporate, government, university and hospital servers for just $6 a piece.
An operation to close it down revealed the site had facilitated tax fraud, ransomware attacks and identity theft to the tune of at least £51 million. The Ukrainian pleaded guilty to one charge of the possession of unauthorised access devices and was sentenced in 2021 to 30 months in jail but released immediately due to time served.
An OnlyMonster spokesperson said Kharmanskyi had not been convicted of hacking or cyber- attacks and that his ‘alleged conviction’ was the result of a plea bargain and ‘no adverse inferences’ should be drawn. But this latest case threatens to further expose the murky underbelly of OnlyFans.
Last week, several creators told the BBC that agencies they had joined to earn more money through the platform had tried to control their personal lives and threatened them with violence if they did not comply.
The website denied it turned a blind eye to abuse.
But when the battle between Infinni and OnlyMonster comes to court next year, it is likely to shed more light on the dark network that has supported the British company’s meteoric rise.
DIY INVESTING PLATFORMS
AJ Bell
AJ Bell
Easy investing and ready-made portfolios
Hargreaves Lansdown
Hargreaves Lansdown
Free fund dealing and investment ideas
interactive investor
interactive investor
Flat-fee investing from £4.99 per month
Freetrade
Freetrade
Investing Isa now free on basic plan
Trading 212
Trading 212
Free share dealing and no account fee
Affiliate links: If you take out a product This is Money may earn a commission. These deals are chosen by our editorial team, as we think they are worth highlighting. This does not affect our editorial independence.