Revolut hackers demand $3M in Monero after data breach

Hackers behind the Revolut customer data breach have demanded 6,000 Monero, worth about $3 million, while threatening to sell the stolen records unless the bank pays within 24 hours. Summary Hackers have demanded 6,000 XMR, valued at about $3 million, from Revolut. At least 680 customer accounts were affected after fraudulent government requests passed company checks. Stolen records reportedly include identity documents, verification photos and complete transaction histories. The attackers said blockchain analysis helped them identify customers with large crypto holdings. How Revolut hackers set the 24-hour deadline The Financial Times reported that a group calling itself “iamnotavillain” published the ransom demand on Wednesday alongside a countdown clock. The hackers said Revolut had 24 hours to send 6,000 XMR before they offered the customer records to other criminal groups. At an implied value of about $500 per token, the demand totals approximately $3 million. The group selected Monero because the cryptocurrency is designed to conceal information about the sender, recipient and amount involved in a transaction. According to the FT, no negotiations between Revolut and the hackers had taken place by the time its report was published. Revolut had not said whether it planned to respond to the demand or confirmed that the group controlled the stolen information. You might also like: Kakao sets 6 trillion won revenue target for KakaoAI by 2030 The hackers provided the newspaper with a 60-second screen recording that appeared to display part of the material in their possession. Passports, driving licences, photographs submitted during know-your-customer checks and customer transaction histories appeared in the video, according to the report. At least 680 accounts were affected, although Revolut has publicly described the number only as a “very limited” portion of its customer base. A previous crypto.news report found that Britain’s Information Commissioner’s Office had opened an investigation after the company reported the incident to regulators. Revolut has said its own systems and customer funds were not compromised. Instead, the disclosure occurred after the company received fraudulent requests through an email account using the domain of a legitimate government agency. Fake government requests exposed Revolut customer records Rather than breaking directly into Revolut’s infrastructure, the attackers posed as government officials seeking customer information. The requests carried valid domain-authentication credentials and passed the checks Revolut used to assess their legitimacy. Revolut then supplied customer records before discovering that the requests were fraudulent. Once the scheme was identified, the company said it blocked the email address and contacted the government agency, law enforcement, data-protection authorities and financial regulators. As initial coverage detailed, the information released included full names, dates of birth, occupations, home addresses, email addresses and telephone numbers. Copies of passports or driving licences and selfies provided for identity verification were also among the listed records.