In early 2024 a shadowy cyber‑crime group announced that it had obtained a sizable cache of personal and financial information belonging to users of Revolut, the popular UK‑based digital banking and money‑transfer platform. The group, which has previously been linked to a series of high‑profile data leaks, demanded a ransom of three million US dollars, to be paid in the privacy‑focused cryptocurrency Monero (XMR). In addition to the monetary demand, the hackers threatened to publish or sell the stolen data if their deadline was not met, specifically targeting customers who hold significant amounts of cryptocurrency in their Revolut accounts.
The demand was delivered via an anonymous post on a dark‑web forum, where the attackers claimed to have exfiltrated a database containing names, email addresses, phone numbers, and in many cases, details of the users' crypto holdings and transaction histories. According to the post, the data set also included verification documents such as passports and driver’s licences, which could be leveraged for identity‑theft schemes. The group set a strict 24‑hour window for Revolut to transfer the requested three million dollars in Monero, warning that failure to comply would result in the public release of the information and its sale on underground marketplaces. Revolut responded to the allegations by issuing a statement through its corporate communications team.
The company said it had not received any direct contact from the alleged attackers and that it was currently conducting an internal investigation in collaboration with law‑enforcement agencies. Revolut also emphasized that it has robust security protocols and that it continuously monitors its systems for suspicious activity. The firm reassured its customers that there had been no confirmed breach of its core banking infrastructure and that any compromise of user data would be dealt with swiftly and transparently.
Cyber‑security experts note that the threat model employed by the group is consistent with a growing trend among ransomware‑as‑a‑service operators: rather than encrypting files and demanding a ransom for decryption, they exfiltrate data first, then use the threat of exposure as leverage. This “double‑extortion” tactic has become increasingly common because it adds pressure on victims who may be reluctant to pay a ransom if they fear their confidential information will be leaked to competitors, regulators, or the public. The choice of Monero as the payment method is also noteworthy. Monero is a privacy‑oriented cryptocurrency that obscures the sender, receiver, and transaction amount, making it difficult for investigators to trace the flow of funds.
By insisting on Monero, the attackers aim to reduce the risk of law‑enforcement tracking and increase the likelihood of a successful payout. Industry analysts caution that even if Revolut were to pay the ransom, there is no guarantee that the stolen data would be destroyed or that the perpetrators would not sell it later. In many documented cases, victims who complied with ransom demands still suffered data leaks, as the attackers often retain copies of the stolen files for future exploitation or resale. For customers, the immediate concern is the potential exposure of personal identifiers and financial details.
Identity thieves could use the information to open fraudulent accounts, apply for loans, or conduct phishing attacks that appear highly credible because they reference real personal data. Users who hold cryptocurrency on Revolut should be particularly vigilant, as the attackers specifically mentioned targeting accounts with large crypto balances.
While Revolut’s platform stores crypto assets in custodial wallets, any compromise of account credentials could enable unauthorized transfers. To mitigate risk, security professionals advise users to take several precautionary steps: 1. **Enable two‑factor authentication (2FA)** on all Revolut accounts, preferably using an authenticator app rather than SMS, which is more susceptible to SIM‑swap attacks. 2.
**Monitor account activity** closely for any unauthorized transactions, especially in the crypto section of the app. 3.
**Change passwords** regularly and ensure they are strong, unique, and not reused across other services. 4. **Review personal data** that may have been exposed and consider placing fraud alerts with credit bureaus. 5.
**Stay informed** about any official communications from Revolut regarding the incident, as the company may issue security patches or additional verification steps. Regulators in the United Kingdom and the European Union have expressed heightened concern over the security of fintech platforms, especially after a series of high‑profile breaches in recent years. The UK’s Financial Conduct Authority (FCA) has the authority to investigate potential compliance failures and may impose fines if it determines that Revolut did not meet required data‑protection standards.
Meanwhile, the European Union’s General Data Protection Regulation (GDPR) mandates that companies notify affected individuals and relevant authorities within 72 hours of discovering a breach that compromises personal data. In the broader context, the incident underscores the evolving threat landscape facing digital‑banking services.
As more consumers adopt fintech solutions for everyday transactions, savings, and investment—including cryptocurrency—cyber‑criminals are increasingly motivated to target these platforms for both financial gain and the lucrative resale of personal data. The convergence of traditional banking data with emerging crypto‑asset information creates a richer target for attackers, who can leverage the combined datasets for more sophisticated fraud schemes. While Revolut’s official stance remains that it has not been directly contacted and that no breach has been confirmed, the public warning from the hacker group has already prompted a wave of anxiety among its user base.
The company’s next steps—whether they involve a public disclosure of a breach, a coordinated response with law‑enforcement, or an internal security overhaul—will be closely watched by the fintech community and regulators alike. In summary, a cyber‑crime group has claimed to possess a trove of Revolut user data and is demanding a three‑million‑dollar ransom in Monero, threatening to sell the information if the demand is not met.
Revolut denies any direct contact and is investigating the claim. Experts advise users to bolster their security posture, remain vigilant for suspicious activity, and await further updates from the company and authorities. The episode highlights the increasing sophistication of ransomware attacks that combine data theft with extortion, and it serves as a reminder of the importance of robust security measures in the rapidly expanding world of digital finance.