$3M Monero Ransom Demand Emerges After Revolut Customer Data Breach

A group claiming to be behind an alleged Revolut data breach has demanded $3 million in Monero (XMR), giving the company 24 hours to pay. The attackers said they would sell the allegedly stolen customer information to other criminal groups if the payment was not made.

The group, known as “iamnotavillain,” posted a demand for 6,000 XMR on Wednesday and accompanied it with a countdown timer, according to the Financial Times.

Revolut said it has not received a direct ransom demand or communication from the individuals making the claims. “Revolut has not received any direct contact or demand from the individuals or group making these claims,” a company spokesperson told CoinDesk.

The reported breach involved at least 680 customer accounts. The attackers told the FT that they used blockchain analysis to locate Revolut accounts belonging to customers with significant cryptocurrency holdings.

The group also supplied the newspaper with a 60-second screen recording that appeared to display some of the information it allegedly obtained. The recording reportedly contained passports, driver’s licenses, photographs used for know-your-customer verification and transaction histories.

According to notices previously sent to affected customers, the incident occurred after attackers impersonated government officials and submitted fraudulent requests for customer information. The requests reportedly passed Revolut’s checks, allowing the attackers to obtain customer records before the company identified them as fraudulent.

Revolut previously told CoinDesk that it had blocked the address used in the fraudulent requests and alerted the relevant government agency, law enforcement and regulators. The company said its systems and customer funds were not compromised.

The attackers told the FT that they had not negotiated with Revolut at the time the newspaper published its report.