Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data

Hackers are demanding a $3 million ransom from Revolut after allegedly obtaining customer information through fraudulent government requests over roughly five months. The attackers reportedly compromised a government employee’s account using credentials from an infostealer infection, then used the email account to send requests to Revolut Bank UAB, the Lithuanian subsidiary of the British fintech. Because Revolut is required to respond to legitimate law-enforcement requests, it supplied information without recognising the requests as fraudulent.

SecurityWeek understands that about 680 customers, reportedly including cryptocurrency “whales”, had personal and financial information exposed. Revolut has also notified potentially affected users that passports, email addresses, phone numbers and financial details may have been compromised. The company said it had not received any direct ransom demand from the individuals making the claims.

The threat actor using the name “IAmNotAVillain” has publicly threatened to sell the data, while claiming that a sample is held by a former associate who also claimed responsibility.

The Duel investigations team and Hudson Rock reported that the campaign may have lasted five months, although the attackers separately claimed six months. They also alleged that more than 147GB of data was stolen from an Italian law-enforcement agency, which has opened an investigation. The compromised address appears to belong to an employee of Italy’s Ministry of the Interior.

Hudson Rock said it had identified more than 300 compromised credentials linked to the domain pec.interno.it, but assessed that the attackers probably used existing infostealer logs rather than directly infecting the employees.