In recent weeks a cyber‑crime collective that claims responsibility for a major breach of Revolut’s user database has escalated its tactics, demanding a ransom of three million dollars worth of Monero cryptocurrency. The group has warned that if the payment is not received within a strict 24‑hour window, it will begin to auction off the personal information of millions of Revolut customers on underground markets.
Their statements specifically point to individuals who hold substantial amounts of digital assets, suggesting that the attackers are targeting high‑value accounts in order to maximize the financial impact of their extortion scheme. The threat was first publicised through a series of posts on a well‑known hacking forum, where the perpetrators posted a data dump that allegedly contains names, email addresses, phone numbers, and in some cases, partial financial details of Revolut users. While the exact size of the compromised dataset has not been independently verified, the group claims it includes the personal data of more than 10 million customers worldwide.
The attackers argue that the data is “highly valuable” because it can be used for phishing campaigns, identity theft, and further illicit financial operations. Revolut, a London‑based fintech firm that offers banking services, currency exchange, and cryptocurrency trading, responded to the allegations with a measured statement. The company said it has not received any direct communication from the hackers and that its security teams are actively investigating the incident.
Revolut also emphasized that it has robust security protocols in place, including multi‑factor authentication and encryption of sensitive user information. The firm reassured its customers that there has been no evidence of unauthorized transactions on any accounts and that it will continue to monitor the situation closely. Cyber‑security experts note that the demand for Monero is significant.
Monero is a privacy‑focused cryptocurrency that obscures the sender, receiver, and amount of each transaction, making it a popular choice for illicit actors who wish to conceal the flow of ransom payments. By demanding payment in Monero, the attackers aim to make it more difficult for law‑enforcement agencies to trace the funds, thereby reducing the risk of being caught. The 24‑hour deadline is also a classic pressure tactic used by ransomware groups.
By imposing an extremely short window for payment, the attackers hope to create a sense of urgency that may cause victims to act hastily, often without consulting legal counsel or conducting a thorough risk assessment. In many cases, victims who pay the ransom do not receive the promised de‑cryption keys or data deletion guarantees, and the attackers may simply continue to exploit the stolen information for profit. Industry analysts point out that this incident fits a broader trend of financially motivated cyber‑attacks targeting fintech platforms. As more consumers turn to digital banking and cryptocurrency services, the value of the data stored by these companies has risen dramatically.
Hackers are increasingly focusing on platforms that hold both traditional financial data and crypto‑related assets, because the convergence of these two domains offers multiple avenues for monetisation. If the threatened sale of the data proceeds, it could have far‑reaching consequences for affected users.
Personal data on the dark web can be bundled into “credential stuffing” packages, enabling criminals to attempt login attacks on a variety of services using the same stolen credentials. Moreover, the inclusion of cryptocurrency wallet addresses or transaction histories could facilitate targeted phishing scams that appear legitimate, coaxing victims into sending additional funds to fraudulent addresses. In response to the breach, security professionals recommend that Revolut users take immediate steps to protect themselves.
These include enabling two‑factor authentication for all accounts, reviewing recent transaction histories for any unauthorized activity, and changing passwords on any other services that may share the same email address or phone number. Users are also advised to be vigilant for suspicious emails or messages that reference the breach, as attackers often use the publicity surrounding a leak to launch follow‑up scams.
Regulators in the United Kingdom and the European Union have expressed concern over the growing number of data breaches affecting financial institutions. Under the General Data Protection Regulation (GDPR), companies are required to notify affected individuals and supervisory authorities within 72 hours of becoming aware of a breach that poses a risk to personal rights and freedoms. While Revolut has not yet disclosed a formal breach notification, the company’s ongoing investigation may lead to such a disclosure if the allegations are substantiated.
The broader fintech community is watching the situation closely, as the outcome may set a precedent for how similar incidents are handled in the future. If Revolut decides to pay the ransom, it could embolden other criminal groups to adopt comparable extortion tactics, potentially leading to a surge in ransomware demands across the sector. Conversely, a refusal to negotiate and a successful law‑enforcement response could deter future attackers, demonstrating that paying ransoms does not guarantee the safe return or destruction of stolen data. In summary, a shadowy hacking group has claimed responsibility for a large‑scale breach of Revolut’s customer database and is demanding a three‑million‑dollar ransom in Monero, with a 24‑hour deadline.
The attackers have threatened to monetize the data by selling it to other criminal actors if their demands are not met. Revolut has denied any direct contact from the perpetrators and is conducting an internal investigation while reassuring customers that no fraudulent activity has been detected on their accounts. Security experts advise users to strengthen their account protections and remain alert for any suspicious communications. The incident underscores the heightened risk facing fintech firms and highlights the need for robust security measures, rapid incident response, and clear communication with regulators and customers in the event of a data breach.