Hackers claiming responsibility for the recent exposure of Revolut customer information have escalated the incident with a public $3 million ransom demand.
The group, calling itself “iamnotavillain,” posted an ultimatum demanding 6,000 Monero, worth roughly $3 million at the time. The attackers gave Revolut 24 hours to pay and threatened to sell the customer information to other criminal groups if the company refused.
Despite the public threat, Revolut says it has not received a ransom demand directly from the group and has had no contact with those making the claims.
The extortion attempt follows the disclosure of a security incident in which an unauthorized party obtained sensitive information belonging to hundreds of Revolut customers.
Rather than breaking directly into Revolut’s banking infrastructure, the attackers used fraudulent information requests that appeared to originate from a legitimate government agency email domain. Revolut responded to those requests and disclosed customer information before discovering the deception.
Around 680 customers are understood to have been affected. Information exposed in the incident included identity and contact details. Notifications sent to affected customers showed that the compromised information could include dates of birth, postal and email addresses, phone numbers and copies of identity documents such as passports and driving licenses.
Depending on the customer, verification selfies, account statements and transaction histories may also have been exposed. The attackers claim they obtained the information after gaining access to an Italian government communications system and using it to impersonate law enforcement officials. They have also claimed that customers with substantial cryptocurrency holdings were deliberately targeted.
Those details remain partly based on the attackers’ own account of the operation and have not all been independently confirmed. The group has attempted to demonstrate possession of the information by sharing material that appears to contain customer records. It also reportedly provided a short screen recording showing someone browsing a collection of documents.
The $3 million demand is being made in Monero, a cryptocurrency designed to provide greater transaction privacy than many other digital currencies.
The public nature of the ultimatum is notable because cyber extortion groups commonly attempt to negotiate privately with victims before publishing threats or stolen information. In this case, Revolut says no such negotiation has taken place.
Italian authorities are investigating how an official government communication channel was allegedly abused and whether the underlying email account or associated systems were compromised.