Revolut faces $3 million ransom demand following data breach

Fintech company Revolut is currently facing a major security crisis after cybercriminals known as "iamnotavillain" demanded a $3 million ransom, payable in 6,000 Monero. The group has issued a 24-hour ultimatum, threatening to sell stolen customer data, including passports, driver's licenses, and transaction histories, to other criminal organizations if their demands are not met. Revolut has categorically rejected the extortion attempts and clarified that no negotiations are taking place.

The breach occurred after attackers successfully impersonated Italian government officials using deceptive PEC (certified email) credentials over several months. This ruse tricked the bank into voluntarily handing over sensitive documents for approximately 680 customers. The bank only identified the fraud after verifying the requests with Italian authorities, who confirmed the emails were fraudulent.

Following the disclosure, Revolut reported the incident to the British data protection regulator, while Italian judicial authorities have opened an investigation into electronic fraud and illegal access to computer systems. The company is currently working to mitigate the impact on its users and assess the extent of the exposure. No direct communications with the hackers have been established by the firm to date.