A criminal group has demanded $3 million in Monero cryptocurrency from Revolut after obtaining personal and financial information on approximately 680 customers through fraudulent requests that impersonated a government agency.
The group, which calls itself iamnotavillain, posted its demand on Wednesday on a website it set up. The ultimatum sought $3 million, or 6,000 XMR, and included a digital countdown clock giving Revolut 24 hours to pay.
The attackers said they would sell hundreds of customers' identity documents and transaction records to other criminals if the demand was not met. The group told the Financial Times that the notification was its first attempt to contact Revolut and that there had been no negotiations with the company.
Revolut said on Wednesday evening that it had received no direct contact or demand from the people or group making the claims. It described the incident as a sophisticated external impersonation scam and said its funds and systems were untouched.
The company disclosed on 12 September that it had inadvertently released sensitive customer information after receiving fraudulent data requests that appeared to have come from a legitimate government agency email domain. The requests targeted Revolut Bank UAB, the company’s Lithuania-based subsidiary, over a period of five to six months.
The requests arrived through a compromised Italian government email system. They came from the agency’s genuine email domain and carried valid authentication, leading Revolut to hand over customer data, according to the information disclosed about the breach.
The hackers gained access to a government employee’s accounts through an infostealer infection, which they then used to send the fraudulent requests. The group claimed its campaign lasted for six months.
The compromised material included customers’ full names, dates of birth, occupations, addresses and contact details. It also included passports, drivers’ licences, financial statements and facial verification images.
Revolut has called the number of affected customers limited. Twelve people in Ireland had their personal information compromised.
A source familiar with the matter said Revolut’s core infrastructure, databases and customer accounts had not been hacked. The company has declined to identify the government agency involved.
It remains unclear whether Revolut will pay the demand, whether any negotiations will begin, or whether any of the stolen data has been sold or released elsewhere. The identities of the people behind iamnotavillain are also unknown.
Comments (0)