The hacker group known as iamnotavillain has demanded 6000 XMR, valued at approximately $3 million, from the fintech company Revolut. The group threatened to sell the personal data of clients if the payment was not made within 24 hours of their ultimatum, which was posted on September 16.
Revolut stated that it has not received any direct communication or demands from the group. The company confirmed that its internal infrastructure and databases were not compromised. The incident involved the unauthorized disclosure of information after the firm processed fraudulent requests that appeared to originate from government agencies.
The breach reportedly affected approximately 680 clients, primarily located in Switzerland and France, with others spread across 31 additional countries. The exposed data includes names, contact details, identification documents, selfies, bank statements, and transaction histories. Former Mt. Gox CEO Mark Karpeles was among those notified of the data leak.
According to reports, the attackers utilized a compromised Italian PEC email address to pose as law enforcement officials over several months. Revolut has since blocked the address and notified relevant regulatory and data protection authorities. The company maintains that user funds remain secure and were not impacted by the event.
