Threats to sell the confidential data of hundreds of Revolut customers to other criminal organizations, were issued by hackers claiming to have breached the major digital bank, demanding a ransom of $3 million within 24 hours in exchange.
According to the Financial Times, the group, which calls itself iamnotavillain, posted the ultimatum on its website on Wednesday afternoon, accompanied by a digital countdown timer.
ΣΧΕΤΙΚΑ ΑΡΘΡΑ
A public ransom demand is unusual, as hackers typically prefer to make such demands privately and only publicize the incident if their target refuses to pay or negotiate. In such cases, they usually post details of the cyberattack on leak sites on the dark web.
In its online message, the group demanded that Revolut pay “6,000 XMR / $3,000,000… otherwise all the data will be sold and the blood will be on your hands.” XMR is the cryptocurrency Monero, which is often used by hackers because its transactions are difficult to trace.
The group told the Financial Times via Telegram that this is the first time it has used this particular website to publicize its demands and that, so far, no negotiations have taken place with Revolut. At the same time, they presented screenshots with certain details redacted from information they claimed to have obtained from the bank.
Shortly after publishing the ransom demand, the hackers sent the FT a 60-second screen recording, in which an unidentifiable user appeared to be browsing through files supposedly originating from Revolut.
The documents shown in the video appeared to include driver’s licenses, passports, and ID photos of Revolut customers—which had been used as part of the “Know Your Customer” (KYC) verification process—as well as transaction histories. The data breach is estimated to have affected at least 680 customer accounts.
According to the Financial Times, the hackers obtained the files after breaching an Italian government email system. Through this system, they reportedly posed as law enforcement officials and, over several months, requested information about specific Revolut customer accounts.
The group claimed that it selected its targets using blockchain analysis to identify Revolut accounts with significant cryptocurrency holdings.
Revolut stated on Wednesday evening that it “has not received any direct communication or demands from the individuals or group making these claims.”
Several Revolut customers who were reportedly affected have expressed concern that their personal data may have been compromised.
Revolut had previously stated that it is providing “immediate support” to affected customers and that it is “working closely with the relevant law enforcement and regulatory authorities.”
Since its founding in 2015, Revolut has grown into Europe’s largest fintech company, operating as a bank in more than 30 countries and serving 80 million customers. Its valuation recently reached $115 billion as part of a secondary share offering.
Source: Proto Thema
