In a dramatic escalation of cyber‑extortion tactics, a hacking collective that recently infiltrated the financial technology platform Revolut has announced a demand for a three‑million‑dollar ransom payable in the privacy‑focused cryptocurrency Monero. The group, which has not publicly disclosed its name, warned that it will put the personal data of Revolut’s users up for sale if the company does not meet its deadline, which is set at just 24 hours from the time of the threat.
The extortion note, which was circulated through underground forums and encrypted messaging channels, claims that the attackers have successfully exfiltrated a substantial amount of sensitive information from Revolut’s databases. According to the threat, the stolen data includes personal identification details, contact information, and, most critically, the crypto‑wallet addresses and transaction histories of users who hold significant amounts of digital assets. By focusing on customers with large cryptocurrency holdings, the hackers aim to maximize the perceived value of the data and pressure Revolut into paying the hefty sum.
Monero was specifically requested as the payment method because of its strong anonymity features. Unlike Bitcoin, which can be traced through public ledgers, Monero employs sophisticated cryptographic techniques that obscure transaction amounts, sender, and receiver details. This makes it a preferred currency for illicit actors who wish to conceal the flow of illicit funds.
The demand for three million dollars in Monero translates to a substantial amount of the cryptocurrency, reflecting both the attackers’ confidence in their leverage and the high stakes involved in the breach. Revolut, a UK‑based fintech firm that has grown rapidly by offering a suite of banking, payment, and crypto services, responded to the allegations with a measured statement.
The company said it has not received any direct communication from the individuals or group claiming responsibility for the breach. Revolut also emphasized that its security teams are actively investigating the incident and are working with relevant law‑enforcement agencies to determine the scope of the compromise. The firm reassured its customers that it continues to employ robust security measures, including encryption, multi‑factor authentication, and continuous monitoring of its systems. The broader context of the incident underscores a growing trend in which cyber‑criminals target financial service providers that handle both fiat and digital currencies.
As more consumers adopt cryptocurrencies for investment and everyday transactions, the data held by platforms like Revolut becomes increasingly valuable. Personal identifiers combined with crypto‑wallet information can enable identity theft, phishing attacks, and unauthorized transfers of digital assets.
Moreover, the sale of such data on dark‑web marketplaces can fuel further criminal activity, creating a cascade of security risks for affected individuals. Industry analysts note that the choice to demand payment in Monero is not accidental. Over the past few years, privacy‑centric coins have risen in popularity among cyber‑crime groups because they complicate forensic analysis. While law‑enforcement agencies have developed tools to trace Bitcoin and Ethereum transactions, Monero’s ring signatures, stealth addresses, and confidential transactions make it far more resistant to tracking.
This shift reflects an arms race between cyber‑threat actors and investigators, with each side adopting more sophisticated technologies to outmaneuver the other. The 24‑hour deadline is a classic pressure tactic in ransomware and extortion schemes. By imposing an extremely tight window for payment, attackers aim to limit the victim’s ability to coordinate a response, seek legal counsel, or involve authorities.
In many cases, companies that have paid ransoms under similar time constraints have later discovered that the promised data deletion or non‑disclosure did not occur, leading to further reputational damage. For customers of Revolut who may be concerned about the potential exposure of their data, experts recommend several precautionary steps. First, users should enable all available security features on their accounts, such as two‑factor authentication (2FA) and biometric login options.
Second, individuals with cryptocurrency holdings should consider moving their assets to hardware wallets that store private keys offline, reducing the risk of unauthorized access. Third, monitoring for suspicious activity—such as unexpected login attempts, unfamiliar transaction alerts, or phishing emails that reference personal details—can help detect early signs of compromise. Finally, staying informed about official communications from Revolut and following any recommended actions, such as password resets or additional verification processes, is crucial. The incident also raises questions about the regulatory environment surrounding fintech firms and crypto services.
In many jurisdictions, financial institutions are required to adhere to stringent data protection standards, such as the General Data Protection Regulation (GDPR) in the European Union. A breach that involves personal data and financial information could trigger mandatory breach notifications, hefty fines, and increased scrutiny from regulators. Revolut’s response and transparency will likely be evaluated by supervisory bodies to ensure compliance with these obligations. While the full extent of the data leak remains unclear, the public nature of the threat serves as a stark reminder of the evolving threat landscape facing digital finance platforms.
As cyber‑criminals refine their tactics—leveraging privacy‑preserving cryptocurrencies, imposing rapid payment deadlines, and targeting high‑value users—companies must continuously adapt their security posture. This includes investing in advanced threat detection, conducting regular penetration testing, and fostering a culture of security awareness among employees and customers alike. In summary, a yet‑unidentified hacking group has claimed to have stolen a significant trove of Revolut user data and is demanding a $3 million ransom in Monero, with a 24‑hour ultimatum. Revolut has denied any direct contact from the attackers and is investigating the matter.
The situation highlights the heightened risk to fintech firms that manage both traditional and crypto assets, the appeal of privacy‑focused cryptocurrencies for illicit payments, and the importance of robust security practices for both providers and users. As the investigation unfolds, stakeholders will be watching closely to see whether the ransom is paid, whether the data is indeed put up for sale, and how regulators respond to this high‑profile breach.