LONDON - A cybercriminal syndicate that tricked British fintech giant Revolut into handing over sensitive customer records is attempting to extort the company for $3 million in cryptocurrency, threatening to auction private dossiers of high-net-worth users unless paid within 24 hours.
Revolut told Reuters on Wednesday that it has received no direct communications or ransom demands from the extortionists, who operate under the moniker “iamnotavillain”.
The standoff exposes a sharp escalation in tactics targeting major financial institutions: bypassing firewalls entirely to trick compliance personnel through spoofed legal requests. While Revolut stressed that its underlying banking engines and user deposits remain uncompromised, the leak of detailed identity profiles poses serious identity-theft and targeting risks for the victims involved.
Exploiting Law Enforcement Channels
The incident was not the result of malware, network intrusion, or compromised internal credentials, according to a person familiar with the matter.
Instead, the perpetrators leveraged a compromised, legitimate government agency email domain to send official-looking requests for customer disclosures directly to Revolut’s compliance department. Believing they were complying with lawful government process, staff fulfilled the requests, inadvertently releasing comprehensive records for roughly 680 customers before the fraud was detected and access cut off.
According to reports corroborated by TechCrunch and independent blockchain sleuth ZachXBT, the compromised records contain:
Scanned government identity documents, including passports and driver's licenses
Account onboarding "selfie" photos
Residential addresses, phone numbers, and dates of birth
Granular financial and transaction records
Security analysts noted that the attackers appear to have targeted users holding sizable cryptocurrency balances, cross-referencing public blockchain activity with identities held on the platform.
A 24-Hour Ultimatum
The extortion campaign escalated into public view when the group published an ultimatum on a dedicated site featuring a digital countdown clock, as first reported by The Financial Times.
The perpetrators demanded roughly 6,000 Monero (XMR) - an untraceable privacy coin worth approximately $3 million - and provided reporters with a 60-second video sample displaying stolen government IDs and internal records to authenticate their claims. The group told the newspaper it launched the site to issue its demands publicly because Revolut had not engaged in private negotiations.
Unlike Bitcoin, Monero obscures transaction sums, senders, and receivers, making the currency a preferred tool for extortion syndicates seeking to evade forensic financial tracing.
Regulatory Fallback
Revolut has moved quickly to contain the fallout, alerting the affected accountholders and filing mandatory notifications with supervisory bodies, including the UK Information Commissioner's Office.
"Revolut systems and customer funds are unaffected," a spokesperson said. "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators."
The breach hits at a sensitive juncture for the London-based company, which has spent the past two years overhauling its risk governance in preparation for a marquee initial public offering. For prospective investors and global regulators, the breach is a stark reminder that the softest target in financial cybersecurity often remains the human inbox.