Hackers demand Revolut pay $3mn ransom after data breach

Hackers who claim they were behind a data breach at Revolut have threatened to sell the confidential records of hundreds of customers to other criminal groups unless the British online bank pays a ransom of $3mn within 24 hours.

The group, which calls itself iamnotavillain, published the ultimatum on its website on Wednesday afternoon next to a digital countdown clock.

The public demand is unusual given hackers usually prefer to make ransom requests privately and go public only if the target refuses to pay or engage, usually by publishing details of the hack on a dark-web leak site.

The online message told Revolut to pay “6,000 XMR / $3,000,000 . . . otherwise all the data will be sold, and the blood will be on your hands”. XMR is the cryptocurrency Monero, which is popular with hackers given its transactions are difficult to trace.

The group told the FT it was using the website to make its demands for the first time and that there had not yet been any negotiations with Revolut.

The FT contacted the hackers via Telegram after they first set up the website late on Monday, displaying redacted screenshots of some of the information allegedly obtained from the bank.

Shortly after posting the ransom demand, the hackers sent the FT a 60-second screen-capture video showing an unseen user moving through the cache of purported Revolut documents.

The documents shown in the video appeared to include Revolut customers’ driving licences, passports, identity pictures used during the “know your customer” verification process and transaction histories.

The data breach is understood to have affected at least 680 customer accounts.

The hackers obtained the files by compromising an Italian government email system, which they used to pose as law enforcement and demand information on specific Revolut client accounts over several months, the FT reported on Tuesday.

The group said it selected the targets by using blockchain analysis to identify Revolut accounts with significant crypto holdings.

Revolut said on Wednesday evening: “Revolut has not received any direct contact or demand from the individuals or group making these claims.”

Several affected Revolut customers have expressed concern that their personal data was compromised.

Revolut previously said it was providing affected customers with “immediate support” and “working closely with relevant law enforcement and regulatory authorities”.

Since launching in 2015, Revolut has become Europe’s biggest financial technology company, operating as a bank in more than 30 countries and serving 80mn customers. It was recently valued at $115bn in a secondary share sale.