In early 2024, a cyber‑criminal collective that had previously claimed responsibility for a major data breach at the financial technology firm Revolut resurfaced with a new extortion demand. This time, the group announced that it had exfiltrated a substantial amount of personal and financial information belonging to Revolut’s user base and was demanding a payment of three million US dollars, to be made in the privacy‑focused cryptocurrency Monero (XMR). The hackers warned that if their deadline—exactly twenty‑four hours from the moment of their public notice—was not met, they would begin to auction off the stolen data on underground markets, potentially exposing millions of customers to fraud, identity theft, and further financial loss.
The threat was communicated through a series of posts on a well‑known hacker forum, where the group detailed the scope of the breach and the criteria used to select its targets. According to the message, the attackers had focused on Revolut accounts that held significant cryptocurrency balances, reasoning that those users would be more likely to pay a hefty ransom in order to protect their assets. The post listed a range of data points that had allegedly been taken, including full names, email addresses, phone numbers, residential addresses, dates of birth, and, crucially, links to the users’ crypto wallets. In several instances, the hackers claimed to have also obtained verification documents such as passports and driver’s licences, which could be used to forge new accounts or bypass security checks on other platforms.
Revolut’s official response was swift but measured. In a statement released to the press, the company said it was aware of the public claim and was working closely with law‑enforcement agencies and cybersecurity experts to investigate the incident. Revolut emphasized that it had not received any direct communication from the attackers—no emails, phone calls, or encrypted messages—beyond the public posts on the forum.
The firm also reassured its customers that no evidence of unauthorized withdrawals or transfers had been found in its internal monitoring systems. Nevertheless, the company warned users to stay vigilant, to enable two‑factor authentication, and to review any recent activity on their accounts for signs of suspicious behavior. The demand for Monero is significant because the cryptocurrency is deliberately designed to obscure the flow of funds, making it difficult for investigators to trace transactions back to the perpetrators. Unlike Bitcoin, where every transaction is publicly recorded on a blockchain that can be analyzed, Monero employs stealth addresses, ring signatures, and confidential transactions to hide both the sender’s and receiver’s identities, as well as the amounts transferred.
This level of anonymity makes it a preferred choice for ransomware operators and data‑extortion groups seeking to evade detection. Cyber‑security analysts have noted that this incident follows a pattern observed in recent high‑profile data breaches, where attackers not only steal information but also leverage it for extortion. By demanding payment in a privacy‑centric coin, the group aims to increase the likelihood that the victim—here, a large fintech firm—will comply rather than risk the public release of sensitive data.
The threat of selling the information on darknet marketplaces adds further pressure, as such sites routinely host listings for personal data packages, often priced per record or per thousand records, with buyers ranging from fraudsters to nation‑state actors. The potential impact on Revolut’s customers could be severe. If the stolen data were to be sold, malicious actors could use it to craft sophisticated phishing campaigns, impersonate users to gain access to other financial services, or even open new accounts in victims’ names.
For those holding significant crypto holdings, the risk is amplified: with wallet addresses and private keys potentially compromised, attackers could attempt to siphon funds directly from the victims’ cryptocurrency accounts. While Revolut has implemented multiple layers of security, including biometric authentication and transaction monitoring, the breach underscores the challenges fintech companies face in protecting massive volumes of sensitive data. In response to the threat, security experts recommend a series of immediate steps for affected users. First, enable all available security features on the Revolut app, such as biometric login, PIN protection, and device‑based authentication.
Second, monitor account statements closely for any unauthorized transactions, especially those involving cryptocurrency purchases or transfers. Third, consider changing passwords not only for Revolut but also for any linked email accounts, as compromised email credentials could be used to reset financial passwords. Finally, users should be wary of unsolicited communications that reference the breach or request additional personal information, as these could be phishing attempts designed to harvest further data.
The broader fintech industry is watching the situation closely. Data breaches of this magnitude raise questions about the adequacy of current regulatory frameworks, the responsibilities of financial service providers to safeguard user information, and the effectiveness of existing incident‑response protocols.
Some regulators have begun to call for stricter reporting requirements and higher standards for encryption and data segregation, arguing that the rapid growth of digital banking and crypto services has outpaced the security measures traditionally employed by legacy banks. While the final outcome of this particular extortion attempt remains uncertain, the episode serves as a stark reminder of the evolving threat landscape facing modern financial institutions. As cyber‑criminals become more sophisticated in both their technical capabilities and their extortion tactics, companies like Revolut must continue to invest heavily in threat intelligence, real‑time monitoring, and robust encryption to protect their customers.
Simultaneously, users themselves bear a share of the responsibility: staying informed about security best practices, regularly updating credentials, and remaining skeptical of unexpected requests for personal data are essential habits in an era where digital assets are increasingly valuable and vulnerable. In summary, a hacker group that previously claimed responsibility for a Revolut data breach is now demanding a $3 million ransom in Monero, threatening to auction off the stolen information if their 24‑hour deadline is not met.
Revolut has denied any direct contact from the attackers and is cooperating with authorities, while urging its users to enhance security measures. The incident highlights the growing trend of data‑theft extortion, the appeal of privacy‑focused cryptocurrencies for illicit payments, and the need for both firms and consumers to adopt rigorous security practices to mitigate the fallout from such attacks.