Revolut faces $3 million ransom threat after customer data breach

Traders Union
All News
Financial News
Revolut data breach ransom

Highlights

Ransomware group iamnotavillain demands 6,000 XMR or $3,000,000 from Revolut after breaching at least 680 customer accounts, exposing sensitive documents.
The attackers accessed files by compromising an Italian government email system and impersonating law enforcement to target Revolut accounts with significant crypto holdings.
The breach affects Europe's largest fintech bank, Revolut, which serves 80 million customers and was valued at $115 billion, raising substantial compliance and trust risks.

Ransom demand and breach details

As first reported by the Financial Times, the group calling itself iamnotavillain posts the ultimatum online on Wednesday alongside a digital countdown clock and says there have not yet been negotiations with Revolut.

The message tells Revolut to pay "6,000 XMR / $3,000,000 ... otherwise all the data will be sold". XMR refers to Monero, a cryptocurrency widely used by hackers because its transactions are difficult to trace.

The public demand is unusual because ransomware groups typically make such requests privately and go public only if a target refuses to engage. The attackers also send the Financial Times a 60-second screen capture that appears to show a cache of Revolut documents, including customers' driving licences, passports, identity images used in know your customer checks and transaction histories.

The breach is understood to affect at least 680 customer accounts. The hackers say they identify targets through blockchain analysis aimed at finding Revolut accounts with significant crypto holdings.

Operational and industry implications

The Financial Times reports that the files are obtained after the group compromises an Italian government email system and then poses as law enforcement over several months to request information on specific Revolut client accounts.

Revolut declines to comment on the ransom demand. The bank previously says it is providing affected customers with immediate support and working closely with relevant law enforcement and regulatory authorities.

Founded in 2015, Revolut operates as a bank in more than 30 countries and serves 80 million customers, making it Europe's biggest fintech. The incident raises compliance and trust risks for a company recently valued at $115 billion in a secondary share sale, especially as affected customers express concern over the exposure of sensitive personal data.

Our earlier article covered the cyber extortion threat facing Revolut after hackers claiming to be “iamnotavillain” alleged they had obtained sensitive customer records and demanded 6,000 XMR (about $3 million) within 24 hours. We noted the breach was said to impact at least 680 accounts, with attackers allegedly using a compromised Italian government email system to pose as law enforcement and request client information—highlighting rising compliance and reputational risks for major fintechs handling KYC data.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.