Reported by
A group claiming responsibility for a recent Revolut data breach has demanded 6,000 Monero—an untraceable, privacy-focused cryptocurrency—worth about $3 million, threatening to sell sensitive information belonging to hundreds of the fintech company’s customers if it is not paid within 24 hours.
The group, calling itself “iamnotavillain,” posted the ultimatum on its website on Wednesday alongside a countdown clock. It threatened to sell the information to other criminal groups if Revolut failed to pay.
A Revolut spokesperson told Reuters late Wednesday that the company had received no direct contact or ransom demand from the people claiming responsibility for the breach, and that there had been no negotiations with them.
The company first confirmed the breach on September 12, saying an unauthorized party had submitted fraudulent requests for customer information using an email account on the legitimate domain of a government agency. Revolut said its own systems and customer funds were not compromised and that it blocked the address after discovering the fraud.
The compromised information could include names, dates of birth, home and email addresses, phone numbers, passports or driver's licenses, verification selfies, bank statements and transaction histories, including Bitcoin transactions, according to notifications sent to affected customers and reviewed by TechCrunch.
The breach is understood to have affected around 680 customers, according to a source familiar with the incident cited by Reuters. The attackers told the Financial Times they had used a compromised Italian government email system to pose as law enforcement officials and request information about specific Revolut customers over several months. They said they used blockchain analysis to identify customers with significant cryptocurrency holdings. Revolut has not independently confirmed those details.
The attackers have also begun publishing information allegedly belonging to individual Revolut customers, including several high-profile clients. They have accused the company of improperly disclosing customer information across jurisdictions, although that claim has not been independently verified and no regulator has publicly concluded that Revolut breached data-protection rules on that basis.
Italian authorities have since stepped up their investigation. Prosecutors in Reggio Calabria opened an inquiry into suspected unauthorized access to a computer system of public interest after investigators linked the fraudulent requests to an institutional email account belonging to the Reggio Calabria prefecture. Investigators are still trying to establish whether the government email system was actually breached or whether the account was cloned.
Italy’s National Anti-Mafia and Anti-Terrorism Directorate has also become involved because the suspected intrusion involved a government entity. Postal police are analyzing the claim made by “iamnotavillain” and monitoring the dark web for any attempt to sell the stolen Revolut customer data.
The latest $3 million demand differs sharply from an earlier claim circulating online that Revolut was being asked to pay 10,000 Bitcoin. That demand was associated with another account calling itself “Revolut Smilik.” The “iamnotavillain” group has said that the other claimant was an impersonator or former associate who had obtained only part of the stolen data; that account of the dispute has not been independently verified.
