Revolut Ransom Note Asks for 6,000 Monero and a Little Trust 🕵️

Hackers claiming responsibility for a Revolut customer-data breach are demanding 6,000 monero ($XMR), roughly $3 million, within 24 hours, warning they will sell the stolen records to other criminal groups if the fintech refuses to pay, the Financial Times reported. The group, which calls itself "iamnotavillain," posted the demand on Wednesday alongside a countdown clock.

At least 680 Revolut customer accounts were affected by the breach, according to the FT. The hackers told the newspaper they used blockchain analysis to identify Revolut users with significant crypto holdings before selecting their targets, and that there had been no negotiations with Revolut at the time of publication.

The attackers sent the FT a 60-second screen recording that appeared to show some of the stolen material, including passports, driving licences, photographs used for know-your-customer checks and transaction histories, the newspaper reported. Monero, the cryptocurrency requested in the ransom, is designed to obscure transaction details.

According to notices previously sent to affected customers, the breach occurred after attackers posed as government officials and sent information requests that passed Revolut's internal checks; Revolut handed over customer records before discovering the requests were fraudulent. Revolut has previously told CoinDesk that it blocked the address used in the fraudulent requests and notified the relevant government agency, law enforcement and regulators, and that its systems and customer funds were unaffected. Revolut did not respond to CoinDesk's request for comment by publication.