In recent weeks, a shadowy cyber‑crime group has surfaced claiming responsibility for a major data breach at Revolut, the popular UK‑based fintech platform that offers banking, currency exchange, and cryptocurrency services to millions of users worldwide. According to the group’s public statements, the attackers have accessed a trove of personal and financial information belonging to Revolut’s customers and are now demanding a ransom of three million US dollars, to be paid in the privacy‑focused cryptocurrency Monero (XMR). They have also warned that if the demand is not met within 24 hours, they will begin selling the stolen data on underground markets, targeting especially those customers who hold substantial amounts of crypto assets. The threat was first reported by several cybersecurity news outlets after the group posted a message on a well‑known hacking forum.
In the post, the perpetrators claimed to have exfiltrated a “large volume” of data, including names, email addresses, phone numbers, account identifiers, and, crucially, details about users’ cryptocurrency holdings and transaction histories. They emphasized that the most valuable records belong to high‑net‑worth individuals who use Revolut’s crypto wallet service to buy, sell, and store digital assets such as Bitcoin, Ethereum, and a variety of altcoins. The group’s demand is unusually specific: three million dollars in Monero.
Monero is chosen because it provides strong anonymity features that make tracing the funds extremely difficult for law‑enforcement agencies. By insisting on this privacy‑centric coin, the attackers are signaling a sophisticated understanding of both the financial motivations of the victims and the technical means required to evade detection. The 24‑hour deadline adds pressure, suggesting the group wants a swift payout before the breach becomes public knowledge and before any potential counter‑measures can be deployed.
Revolut’s official response, released through a corporate blog post and a series of statements to the press, has been measured but firm. The company says it has not received any direct communication from the hackers, such as encrypted emails or dark‑web messages, that would allow it to verify the authenticity of the claim. Nevertheless, Revolut’s security team has launched an internal investigation, involving third‑party forensic specialists, to determine whether any unauthorized access has indeed occurred.
The firm also reassured its users that all standard security protocols remain in place, including two‑factor authentication, biometric login options, and continuous monitoring for suspicious activity. Industry experts note that the scenario fits a broader pattern of extortion tactics that have become more common in the financial technology sector.
Unlike traditional ransomware, which encrypts a victim’s data and demands payment for the decryption key, this type of “double‑extortion” involves both encrypting data and threatening to publish or sell it if the ransom is not paid. The attackers aim to leverage the reputational damage and potential regulatory fallout that could arise from a public data leak, especially when it involves sensitive financial information. From a regulatory perspective, a breach of this magnitude would trigger obligations under the European Union’s General Data Protection Regulation (GDPR) and the UK’s Data Protection Act. Both frameworks require organizations to notify affected individuals and supervisory authorities within 72 hours of becoming aware of a breach that poses a risk to personal rights and freedoms.
If Revolut confirms that the data was indeed compromised, it would need to issue a detailed breach notice, outlining the nature of the compromised data, the steps taken to mitigate the impact, and advice for customers on how to protect themselves—such as monitoring account activity, changing passwords, and being wary of phishing attempts. Cybersecurity analysts also caution that the public claim itself could be a bluff.
In some cases, threat actors post false claims to generate fear, attract media attention, or test a company’s incident‑response readiness. The lack of direct contact reported by Revolut may indicate that the group is attempting to create a narrative without actually possessing the data, or that they are using an anonymous drop‑point that the company has not yet discovered.
Regardless, the incident underscores the importance of robust security hygiene for both providers and users. For Revolut customers, especially those who hold significant cryptocurrency balances, there are several practical steps to mitigate risk. First, enable all available security features, such as two‑factor authentication (2FA) via an authenticator app rather than SMS, which can be vulnerable to SIM‑swap attacks. Second, consider moving large crypto holdings to hardware wallets that store private keys offline, reducing exposure to online breaches.
Third, regularly review account statements for unfamiliar transactions and set up alerts for any activity that exceeds a predefined threshold. Finally, stay informed about official communications from Revolut and avoid clicking on unsolicited links or providing personal information in response to suspicious emails.
The broader fintech community is watching the situation closely. If the breach is confirmed, it could prompt a wave of regulatory scrutiny and push other digital banking platforms to accelerate their security investments, particularly around crypto‑related services. It may also spark discussions about the need for industry‑wide standards for safeguarding digital asset custodial data, an area that currently lacks the same level of oversight as traditional banking.
In summary, a hacking collective has publicly demanded a $3 million Monero ransom from Revolut, threatening to expose or sell data that allegedly includes detailed information about customers’ cryptocurrency holdings. Revolut denies any direct contact from the attackers and is conducting a thorough investigation. While the authenticity of the claim remains unverified, the episode highlights the evolving threat landscape for fintech firms and the importance of proactive security measures for both providers and users.
As the investigation unfolds, stakeholders are advised to remain vigilant, follow best‑practice security protocols, and await official updates from Revolut regarding the status of the alleged breach.