Revolut data breach group demands $3 million in XMR, threatens criminal sale

A group identifying itself as “iamnotavillain” demanded 6,000 Monero (XMR), valued at approximately $3 million, within 24 hours in exchange for not selling sensitive Revolut customer data to criminal organizations. The threat, which appeared on the group’s website alongside a ticking countdown clock, followed claims of compromising data on about 680 individuals with significant crypto holdings, according to the Financial Times and Reuters. Targeting high-value crypto users The group stated that it identified its targets—whom it called “crypto whales”—by analyzing blockchain data to pinpoint Revolut users with large cryptocurrency balances. Without offering details on the specific methods, the group alluded to sophisticated onchain analysis as the tool that enabled the breach. Most of the affected individuals reportedly reside in Switzerland and France, with others spread across 31 countries, including the U.K., Germany, and Spain. Reuters cited a source with direct knowledge who estimated the number of compromised customer profiles at roughly 680. The illicit actors further claimed to possess 147 gigabytes of sensitive information, which supposedly includes Italian police documents and internal communications among officers. Italian authorities are currently investigating these assertions. Broader investigation widens across Europe Prosecutors in Reggio Calabria, Italy, have launched an inquiry following possible unauthorized access to the prefecture’s certified email account. The compromised account, reportedly used to send fraudulent requests signed as if from the Italian postal police, originated from an interior ministry domain over a span of several months. Authorities have not yet determined if the account was breached or if malicious parties cloned it. Italy’s national anti-mafia and anti-terrorism prosecutors are monitoring ongoing developments. In response to the incident, Italy’s data protection authority has urged banks to review their security protocols for similar intrusions. The agency also contacted its Lithuanian counterpart, as Revolut is headquartered legally in Lithuania. The authorities are now verifying if police documents were among the stolen data. Revolut and regulatory response Revolut confirmed last week that it had provided customer data to an external party after receiving requests from what appeared to be a legitimate government domain. The fraudulent requests included a government agency’s credentialed email address. The records compromised in the breach contained a range of sensitive information, including passports, verification selfies, and transaction histories involving bitcoin. Despite the breach, Revolut emphasized that its core systems and customer funds remain secure. In an earlier statement, the company asserted: “Revolut systems and customer funds are unaffected,” the company stated, seeking to reassure clients following the disclosure of the unauthorized data release. In the aftermath, the U.K. Financial Conduct Authority announced it is working with Revolut to evaluate the scope of the incident and the company’s response to potential customer risks. The Information Commissioner’s Office also confirmed receipt of a report and is currently assessing the situation.