OCCRP: Hackers Demand $3M Ransom in Revolut Data Leak

• The breach affected around 680 customers, with attackers threatening to sell sensitive information if not paid.
• Italian authorities and anti-mafia units are investigating the use of a compromised government email system.

A group called 'iamnotavillain' demanded 6,000 Monero, worth about $3 million, from Revolut, threatening to sell sensitive customer data if not paid within 24 hours. The group claims to have used a compromised Italian government email system to pose as law enforcement and request information about specific customers.

Revolut confirmed the breach on September 12, stating that its systems and customer funds were not compromised and that the fraudulent email address was blocked. Italian authorities, including the National Anti-Mafia and Anti-Terrorism Directorate, are investigating the incident and monitoring the dark web for attempts to sell the stolen data.

• $3 million ransom demand in Monero
• 680 affected Revolut customers
• 6,000 Monero demanded by hackers

• Review all customer data requests received from government email domains, especially those linked to the Reggio Calabria prefecture.
• Monitor for any customer information published or offered for sale on the dark web by 'iamnotavillain' or related groups.
• Update incident response plans to address fraudulent law enforcement requests and cryptocurrency ransom demands, referencing the Revolut breach typology.

This incident highlights the risk of sophisticated social engineering attacks using compromised government email systems to obtain sensitive customer data. The attackers' use of privacy-focused cryptocurrency and threats to sell data on the dark web pose significant challenges for detection and mitigation. Compliance officers must strengthen controls around data requests from official domains and monitor for emerging typologies involving cryptocurrency ransom demands and cross-jurisdictional data exposure.