In early 2024 a cyber‑crime collective that had previously claimed responsibility for a series of high‑profile data leaks announced that it had obtained a substantial amount of personal information from Revolut, the UK‑based financial technology firm. The group, which has not publicly disclosed its name but is commonly referred to in security circles as a “cryptocurrency‑focused extortion outfit,” posted a demand for a payment of three million US dollars worth of Monero, a privacy‑oriented cryptocurrency, and warned that if the ransom was not met within 24 hours they would begin selling the compromised data on underground markets. The threat was broadcast on several hacker forums and on a dedicated Telegram channel that the group uses to communicate with potential victims.
In the message, the attackers claimed that they had specifically targeted Revolut customers who held significant cryptocurrency balances, suggesting that they had filtered the data set to isolate high‑value accounts. They argued that these users would be more likely to pay a ransom in order to protect their assets and avoid the exposure of sensitive financial details. Revolut’s official response was swift but measured.
In a public statement released through its corporate communications team, the company said it had become aware of the claim and was working with law‑enforcement agencies, including the UK’s National Crime Agency and relevant financial regulators, to investigate the matter. The statement also emphasized that Revolut had not received any direct contact from the attackers—no emails, phone calls, or other forms of communication had been reported.
The firm reassured its customers that there was no evidence at that time that any user data had been accessed or misused, and it urged customers to remain vigilant for phishing attempts or suspicious activity. The demand for Monero is notable because the cryptocurrency is designed to obscure the source, destination, and amount of transactions, making it a preferred medium for illicit payments. By asking for three million dollars in Monero, the group is signaling both its technical sophistication and its intent to make tracking the ransom more difficult for investigators.
Analysts note that the amount requested is unusually high for a single extortion case, indicating that the attackers believe the data they hold is of considerable value, either because of the number of accounts compromised or because of the depth of personal and financial information contained within those accounts. Cyber‑security experts have weighed in on the broader implications of the threat. The incident underscores the growing trend of ransomware‑type groups shifting from encrypting victim systems to exfiltrating data and then leveraging that data for extortion.
This “double extortion” model has become common among ransomware gangs, and the Revolut case appears to follow that pattern. By threatening to sell the data on dark‑web marketplaces, the attackers aim to increase pressure on the target, as the potential reputational damage and regulatory fallout from a data leak can be severe for a financial services provider.
If the data were to be released, the fallout could be extensive. Revolut customers typically store a variety of personal identifiers—names, addresses, phone numbers, email addresses—alongside financial information such as bank account numbers, transaction histories, and details about cryptocurrency holdings. Exposure of such data could facilitate identity theft, account takeover, and targeted phishing campaigns.
Moreover, because Revolut operates across multiple jurisdictions, a breach could trigger investigations by regulators in the European Union, the United States, and other regions, potentially resulting in fines and mandatory remediation measures. The incident also raises questions about the security posture of fintech companies that handle both traditional fiat currencies and digital assets. While Revolut has invested heavily in security technologies, the very nature of offering cryptocurrency services introduces additional attack surfaces.
Crypto wallets, even custodial ones, are attractive targets because they can be directly linked to monetary value. As a result, firms in this space are under increasing pressure to adopt robust encryption, multi‑factor authentication, and continuous monitoring to detect anomalous activity. From a legal perspective, the demand for a cryptocurrency ransom places law‑enforcement agencies in a challenging position.
While authorities can track blockchain transactions to some extent, the privacy features of Monero make it substantially more difficult to trace the flow of funds compared with more transparent cryptocurrencies like Bitcoin. This technical barrier often emboldens attackers, who calculate that the risk of being identified is lower when using privacy‑focused coins. In the meantime, Revolut has advised its users to update passwords, enable two‑factor authentication, and be wary of unsolicited communications that request personal or financial information. The company also indicated that it would provide additional support to any customers who suspect that their accounts have been compromised, including offering free credit monitoring services where appropriate.
The broader fintech community is watching the situation closely. The incident serves as a reminder that even well‑funded, globally recognized financial platforms are not immune to sophisticated cyber threats. It highlights the importance of a layered security approach that includes not only technical defenses but also incident response planning, regular security audits, and clear communication strategies for customers.
As the 24‑hour deadline approaches, the outcome remains uncertain. If Revolut chooses to engage with the attackers, it would likely do so through law‑enforcement intermediaries to avoid directly funding criminal activity. Conversely, if the company decides to refuse payment, the attackers may follow through on their threat to monetize the data, potentially causing a cascade of secondary attacks on affected users. Regardless of the path taken, the episode is expected to shape industry discussions around data protection, ransomware response, and the role of cryptocurrency in cyber‑crime for years to come.