Key facts
- Revolut has not received direct contact from any group demanding ransom following a customer data breach.
- A group calling itself "IAmNotAVillain" publicly demanded 6,000 Monero (XMR), valued at approximately $3 million, from Revolut.
- The group threatened to sell stolen customer data, including identity documents and transaction records, if the ransom is not paid within 24 hours.
- The breach allegedly involved a sophisticated external impersonation scam using a compromised Italian government email system.
- Italian authorities, including the National Anti-Mafia and Anti-Terrorism Directorate, are investigating the incident.
- The stolen data reportedly includes names, addresses, passport copies, selfies, account statements, and transaction histories.
Revolut has stated it has not received any direct contact or ransom demand from a group claiming responsibility for a customer data breach, despite public threats to sell stolen information. A group identifying as "IAmNotAVillain" has demanded 6,000 Monero (XMR), approximately $3 million, within 24 hours, threatening to sell customer data if the payment is not made.
The company described the incident as a "sophisticated external impersonation scam" where data was handed over in response to what appeared to be legitimate requests from a government agency's email domain. The Financial Times reported that these requests came via a compromised Italian government email system over several months, affecting at least 680 accounts.
The stolen data is extensive, including names, dates of birth, occupations, home addresses, copies of identification documents, selfies submitted for verification, account statements with IBANs and wallet references, withdrawal records, and full transaction histories. Blockchain investigator ZachXBT noted that the breach appeared to be "targeted at high net worth users," aligning with the group's claims of using blockchain analysis to identify customers with substantial crypto holdings.
Italian authorities, including the National Anti-Mafia and Anti-Terrorism Directorate, have expanded their investigation into the breach, focusing on whether a government email account was compromised or cloned. Revolut has stated that its funds and systems were untouched and that the number of affected customers is "limited."