A cybercriminal group known as iamnotavillain has issued a threatening ransom demand after allegedly stealing sensitive customer data from Revolut, a major digital banking platform. The group is demanding approximately $3 million worth of Monero (XMR) in cryptocurrency to prevent the sale of the stolen information.
According to reports from Traders Union, the hackers claim to have compromised the accounts of at least 680 Revolut customers. The stolen data reportedly includes passports, driver’s licenses, identity verification images used for know-your-customer checks, and detailed transaction histories. The cybercriminals posted an online ultimatum, demanding the ransom payment to be made in 6,000 Monero, a privacy-focused cryptocurrency.
The Financial Times reports that the hackers gained access by infiltrating an Italian government email system and then impersonating law enforcement officials over several months. During this period, they allegedly requested information on specific Revolut accounts. The group used blockchain analysis techniques to identify accounts with significant cryptocurrency holdings, making them high-value targets.
A brief video screenshot provided to the Financial Times appears to show access to what seem to be Revolut documents matching the categories of stolen customer records. Revolut has not issued an official comment regarding the ransom demand. However, the company has assured affected customers that it is providing support and collaborating closely with law enforcement and regulatory agencies to address the breach.
At this stage, there are no reports of negotiations taking place. The hackers have warned that if their demands are not met, the stolen data will be sold to other criminal groups, potentially leading to further misuse or fraud.
Revolut, which serves approximately 80 million customers across more than 30 countries, recently achieved a valuation of $115 billion through a secondary share sale. The incident adds to the growing concerns over cybersecurity threats targeting financial services firms. Previously, reports indicated that attackers had begun publicly posting some of the stolen customer data and demanding ongoing payments, raising alarm over the security of digital banking platforms.
