The hacking group iamnotavillain demands $3 million from Revolut, threatening to sell sensitive client data following a breach affecting 680 users.
The hacking collective iamnotavillain has issued a demand for 6,000 Monero (XMR), equivalent to roughly $3 million, from Revolut, threatening to sell client data to other criminal entities. This ultimatum, which surfaced on their website on September 16, includes a countdown timer, granting Revolut just 24 hours to meet their demands.
In their statement, the hackers warned, "6,000 XMR / $3,000,000... otherwise we will sell all the data, and the blood will be on your hands." They claim responsibility for a recent data breach and stated that they had not attempted negotiations with Revolut prior to this threat.
Despite the hackers' claims, Revolut has stated that they have not received any direct communication from iamnotavillain. A company representative confirmed, "Revolut has not received any direct messages or demands from individuals or groups making these claims."
Details of the Breach
The breach reportedly impacted approximately 680 Revolut clients, with the hackers providing a screen recording that allegedly displays sensitive information, including:
- passports and driver's licenses;
- identity verification photos;
- banking and contact details;
- transaction histories.
iamnotavillain claims they targeted clients based on blockchain analysis, focusing on those with significant cryptocurrency investments. Most affected clients are believed to be from Switzerland and France, with others scattered across 31 countries, primarily in Europe.
Among those affected is former Mt. Gox CEO Mark Karpeles, who criticized Revolut for allegedly providing information following a request from a government address.
Method of Access
On September 12, on-chain researcher ZachXBT suggested that Revolut might have mistakenly accepted fraudulent requests from a government entity as legitimate. The compromised data included names, contact information, document copies, verification selfies, bank statements, and transaction histories, including Bitcoin transfers.
Revolut later acknowledged that sensitive information had been inappropriately shared with unauthorized parties, asserting that the requests came from a legitimate domain of a government agency that passed their internal verification checks. Reports indicate that the hackers impersonated law enforcement officials to gain access to client information.
While Revolut did not verify all details of the breach, they emphasized that their internal systems and databases were not compromised and that user funds remained safe. Following the discovery of these fraudulent requests, the company blocked the offending email address and informed relevant authorities, including law enforcement and financial regulators.
This incident comes amid other security concerns in the cryptocurrency sector, as a class-action lawsuit has recently been filed against Ledger, a hardware wallet manufacturer, for a breach that revealed personal information of clients.
