In early 2024 a cyber‑crime group surfaced claiming responsibility for a large‑scale data breach at Revolut, the UK‑based financial technology firm that offers banking, currency exchange and cryptocurrency services to millions of users worldwide. The group announced that it had exfiltrated a substantial amount of personal and financial information from Revolut’s systems and that it would release or sell the data unless the company complied with its ransom demands. Specifically, the attackers demanded a payment of three million United States dollars, to be transferred in the privacy‑focused cryptocurrency Monero (XMR). They set a strict deadline of 24 hours for Revolut to meet the demand, warning that failure to do so would result in the public exposure of the stolen data and the sale of the information on underground markets.
The ransom note, which was posted on a well‑known hacker forum, emphasized that the group’s primary target was Revolut customers who held significant cryptocurrency holdings. By focusing on users with large crypto balances, the attackers hoped to maximize the perceived value of the stolen data and increase the pressure on the company to pay. The note also highlighted the choice of Monero as the payment method, noting that the cryptocurrency’s built‑in anonymity features make it difficult for law‑enforcement agencies to trace the flow of funds. This choice is consistent with a broader trend among ransomware operators who prefer privacy‑centric coins such as Monero, Zcash or Dash for illicit transactions.
Revolut’s official response to the claim was measured but firm. In a public statement, the company said it had not received any direct contact from the alleged perpetrators and that it was actively investigating the matter in collaboration with cybersecurity experts and relevant authorities. Revolut also reassured its customers that there had been no evidence of unauthorized access to user accounts at the time of the announcement.
The firm emphasized its commitment to security and indicated that it would continue to monitor the situation closely, while also urging users to remain vigilant and follow best practices for protecting their digital assets. The incident raises several important questions about the security of fintech platforms that integrate traditional banking services with cryptocurrency functionalities. Revolut, like many other digital‑only banks, stores a wealth of sensitive data, including personal identification details, banking credentials, transaction histories and, increasingly, wallet addresses and private keys associated with crypto holdings. A breach of this magnitude could potentially expose users to identity theft, financial fraud, and targeted phishing attacks, especially if the stolen information includes links between real‑world identities and cryptocurrency wallets.
From a technical perspective, the attackers likely exploited a vulnerability in Revolut’s web or mobile infrastructure, or possibly leveraged social engineering techniques to gain privileged access. While the exact method of intrusion has not been disclosed, common attack vectors in similar cases include compromised third‑party services, insecure API endpoints, or credential stuffing attacks that take advantage of reused passwords across multiple platforms.
Once inside the network, the threat actors would have been able to locate and extract databases containing user records, then exfiltrate the data to a remote server under their control. The demand for payment in Monero is particularly noteworthy.
Unlike Bitcoin, where every transaction is publicly recorded on a transparent ledger, Monero employs ring signatures, stealth addresses and confidential transactions to obscure the sender, receiver and amount of each transfer. This makes it a preferred choice for cybercriminals seeking to hide the financial trail of ransom payments. Law‑enforcement agencies worldwide have warned that the rise of Monero‑based ransomware poses significant challenges for attribution and prosecution, as the anonymity features can effectively shield perpetrators from detection. In the broader context of ransomware trends, the Revolut case mirrors a growing pattern where attackers not only demand monetary payment but also threaten to leak or sell stolen data.
This “double extortion” model increases the leverage that criminals have over victims, as the fear of reputational damage or regulatory penalties can compel organizations to comply even if they have robust backups and can restore systems without paying. For financial institutions, the stakes are especially high because regulatory frameworks such as the EU’s GDPR and the UK’s Data Protection Act impose severe fines for data breaches, and the loss of customer trust can have long‑term financial repercussions.
Experts advise that companies facing such threats should follow a structured incident‑response plan. This includes isolating affected systems, conducting a forensic investigation to determine the scope of the breach, notifying regulators and affected individuals as required by law, and engaging with reputable cybersecurity firms to mitigate further risks. While paying the ransom might seem like a quick fix, many authorities, including the United States Department of Justice, discourage it, arguing that it funds criminal activity and does not guarantee that the data will be deleted or that the attackers will not target the organization again.
For Revolut’s customers, the immediate takeaway is to adopt stronger security hygiene. Users should enable two‑factor authentication (2FA) on all accounts, use unique, complex passwords for each service, and consider storing large cryptocurrency holdings in hardware wallets rather than on exchanges or fintech apps. Monitoring account activity for unusual transactions, regularly reviewing security settings, and staying informed about official communications from Revolut are also prudent steps.
The incident also underscores the importance of regulatory oversight in the rapidly evolving crypto‑friendly fintech sector. As more traditional banks and neobanks incorporate crypto services, regulators are grappling with how to enforce security standards that protect both fiat and digital assets. Some jurisdictions are introducing mandatory cyber‑risk assessments for firms handling crypto, while others are exploring stricter licensing requirements for custodial services. In summary, a hacker group has claimed responsibility for a data breach at Revolut, demanding a $3 million ransom in Monero and threatening to sell the compromised information if the demand is not met within 24 hours.
Revolut has denied direct contact from the attackers and is working with security experts and authorities to investigate. The case highlights the vulnerabilities inherent in fintech platforms that blend conventional banking with cryptocurrency services, the growing use of privacy‑focused coins for ransom payments, and the escalating tactics of double‑extortion ransomware. Users are advised to strengthen their personal security measures, while the industry as a whole must continue to evolve its defensive strategies and regulatory frameworks to mitigate such threats.