In early June, a cyber‑crime group that has been linked to a series of high‑profile data breaches announced that it had obtained a substantial amount of personal information from users of Revolut, the UK‑based financial technology company that offers banking, currency exchange and cryptocurrency services. The group, which has not publicly identified itself but is believed to be an offshoot of the notorious "Clop" or "LockBit" ransomware collectives, posted a detailed claim on a dark‑web forum, demanding a payment of three million US dollars in Monero, a privacy‑focused cryptocurrency, in exchange for not releasing the stolen data. They also warned that if the ransom was not paid within 24 hours, they would begin selling the compromised records on underground markets. According to the leak, the stolen data set includes names, email addresses, phone numbers, dates of birth, and in many cases, copies of government‑issued identification documents such as passports and driver’s licences.
More critically for the financial sector, the hackers say they have also accessed information related to users’ cryptocurrency wallets, including wallet addresses and transaction histories. The group specifically targeted Revolut customers who hold large amounts of digital assets, suggesting that they aim to extort high‑net‑worth individuals who are more likely to pay a steep ransom to protect their financial privacy. Revolut responded to the allegations in a brief statement released to the press on Monday. The company said it has not received any direct contact from the threat actors and that its security teams are actively investigating the claim.
"We take the security of our customers' data very seriously and are working closely with law‑enforcement agencies to assess the situation," the statement read. Revolut also emphasized that it has robust encryption and monitoring systems in place to detect unauthorized access, and that there is currently no evidence that any customer funds have been compromised.
The demand for payment in Monero is a tactical choice by the attackers. Monero’s blockchain is designed to conceal transaction details, making it extremely difficult for investigators to trace the flow of funds. This level of anonymity has made Monero a popular choice among ransomware operators and data‑theft extortion groups, who prefer to avoid the scrutiny that accompanies more transparent cryptocurrencies such as Bitcoin or Ethereum.
Cyber‑security experts warn that the threat posed by the group extends beyond the immediate risk of data exposure. If the stolen personal information falls into the hands of other criminal actors, it could be used for a range of fraudulent activities, including identity theft, phishing scams, and account takeover attacks.
The inclusion of cryptocurrency wallet details heightens the risk, as criminals could potentially craft targeted social‑engineering campaigns to trick users into sending additional crypto assets to fraudulent addresses. The incident also raises broader concerns about the security of fintech platforms that have rapidly expanded their services to include crypto trading and storage. While Revolut has marketed itself as a user‑friendly gateway to digital assets, the integration of traditional banking functions with cryptocurrency services creates a larger attack surface. Analysts suggest that firms operating in this hybrid space must adopt a layered security approach, combining strong encryption, multi‑factor authentication, continuous monitoring, and regular penetration testing to mitigate the risk of large‑scale data breaches.
In the wake of the claim, several cybersecurity firms have begun monitoring underground forums for any evidence that the stolen data has been uploaded or is being prepared for sale. Early indicators suggest that the hackers may be planning to list the information on a dark‑web marketplace that specializes in high‑value personal data, where prices for full‑profile records can range from a few hundred to several thousand dollars per individual, depending on the richness of the data set. Law‑enforcement agencies in the United Kingdom and across Europe have been alerted to the threat.
The National Cyber Security Centre (NCSC) issued a warning to financial institutions, urging them to review their incident‑response plans and to communicate transparently with customers about any potential exposure. The NCSC also reminded users to be vigilant for unsolicited communications that reference the breach, as attackers often follow up a data leak with phishing emails that appear to be from the compromised company.
For Revolut customers, experts recommend several immediate steps to protect themselves. First, enable two‑factor authentication (2FA) on all accounts, preferably using an authenticator app rather than SMS, which can be vulnerable to SIM‑swap attacks. Second, monitor bank statements and crypto transaction histories for any unauthorized activity, and report suspicious movements to both Revolut and the relevant crypto exchange. Third, consider changing passwords on any services where the same credentials may have been reused, and use a password manager to generate unique, complex passwords for each platform.
The broader financial industry is watching the situation closely. If the demand for a $3 million ransom is met, it could set a precedent for future extortion attempts against fintech firms that hold both fiat and crypto assets. Conversely, a refusal to pay, coupled with a successful law‑enforcement operation that disrupts the attackers, could send a strong deterrent signal to similar groups. In summary, a cyber‑crime syndicate claims to have exfiltrated a large trove of personal and cryptocurrency‑related data from Revolut users and is demanding a three‑million‑dollar ransom in Monero, with a 24‑hour deadline before they allegedly put the data up for sale.
Revolut has denied any direct contact from the perpetrators and is investigating the allegations alongside authorities. The incident underscores the heightened risk faced by fintech platforms that blend traditional banking with digital asset services, and it highlights the need for robust security measures, rapid incident response, and heightened user awareness to mitigate the fallout from such breaches.