In early June, a shadowy collective of cyber‑criminals announced that they had infiltrated the databases of Revolut, the popular UK‑based financial‑technology platform that offers banking, currency exchange, and cryptocurrency services to millions of users worldwide. In a bold and unsettling move, the group posted a public demand for a ransom of three million US dollars, to be paid exclusively in Monero, a privacy‑focused cryptocurrency that makes tracing transactions extremely difficult. They warned that if their demand was not met within a strict 24‑hour window, they would begin to sell or otherwise distribute the stolen personal data of Revolut’s customers, with a particular focus on those who hold substantial crypto assets.
The threat was communicated through a series of posts on a dark‑web forum frequented by ransomware operators and data‑broker networks. The attackers claimed to have exfiltrated a large volume of sensitive information, including names, email addresses, phone numbers, physical addresses, and, crucially, details of customers’ cryptocurrency holdings and wallet addresses. By targeting users with significant crypto balances, the group signaled that they were seeking to maximize their illicit profit, either by extorting the victims directly or by auctioning the data to other criminal actors who could use it for further fraud, phishing, or money‑laundering schemes.
Revolut’s official response to the incident was swift but measured. In a public statement released on its website and social media channels, the company emphasized that it had not received any direct communication from the alleged attackers. Revolut also reassured its user base that its security teams were actively investigating the incident, working closely with law‑enforcement agencies in multiple jurisdictions, and conducting a thorough forensic analysis to determine the scope and impact of the breach. The firm highlighted that it employs multiple layers of encryption and tokenisation to protect user data, and that any compromised information would be limited to what is stored on its servers rather than the encrypted data held in users’ personal devices.
Industry experts have weighed in on the broader implications of the attack. Cybersecurity analysts note that demanding payment in Monero is a strategic choice for ransomware groups because the cryptocurrency’s built‑in privacy features, such as ring signatures and stealth addresses, obscure the flow of funds, making it far more challenging for investigators to track the money once it is transferred. This trend reflects a growing preference among ransomware operators for privacy‑centric coins over more transparent options like Bitcoin, which can be traced through public ledgers. The focus on customers with “significant crypto holdings” also underscores a shift in ransomware tactics.
Traditional ransomware attacks often encrypt a victim’s entire system, forcing the organization to pay to regain access. In contrast, data‑exfiltration‑first attacks, sometimes called “double extortion,” involve stealing data first, then threatening to release it publicly unless a ransom is paid.
By zeroing in on high‑value crypto users, the attackers aim to exploit the fact that these individuals are more likely to have liquid assets that can be quickly converted into cryptocurrency, thereby increasing the likelihood of a successful payment. For users of Revolut and similar fintech platforms, the incident serves as a reminder of the importance of personal security hygiene.
Security professionals recommend several best practices: enabling two‑factor authentication (2FA) on all accounts, regularly reviewing account activity for unauthorized transactions, using strong, unique passwords for each service, and, where possible, storing large cryptocurrency balances in hardware wallets rather than on exchanges or custodial platforms. Additionally, users should be wary of phishing emails that mimic legitimate communications from financial institutions, as these are often used to harvest login credentials that can later be leveraged in large‑scale breaches. Law‑enforcement agencies, including Europol’s European Cybercrime Centre (EC3) and the UK’s National Crime Agency (NCA), have been alerted to the threat.
While the investigation is ongoing, authorities typically advise victims not to pay ransoms, as doing so can fund further criminal activity and does not guarantee that the stolen data will be destroyed or that the perpetrators will not release it later. Instead, they encourage victims to report incidents promptly, preserve any evidence, and cooperate with forensic investigators. The incident also raises questions about regulatory oversight of fintech firms. In the European Union, the General Data Protection Regulation (GDPR) imposes strict obligations on companies that handle personal data, including mandatory breach notification within 72 hours of discovery.
If Revolut’s investigation confirms that personal data was indeed accessed or exfiltrated, the company may be required to inform affected users and regulators, potentially facing substantial fines if it is found to have failed in its duty of care. From a broader perspective, the attack highlights the evolving threat landscape facing financial technology companies. As more consumers adopt digital banking and cryptocurrency services, the amount of valuable data stored in centralized platforms continues to grow, making them attractive targets for sophisticated cyber‑criminal groups. Companies must therefore invest heavily in advanced threat detection, continuous monitoring, and rapid incident response capabilities to mitigate the risk of such breaches.
In summary, a cyber‑criminal group has claimed to have breached Revolut’s systems and is demanding a $3 million ransom in Monero, threatening to expose data on customers, especially those with large crypto holdings, if the demand is not met within 24 hours. Revolut has denied any direct contact from the attackers and is working with authorities to investigate. Experts warn that paying the ransom is unlikely to guarantee data safety and may encourage further attacks. Users are urged to strengthen their security practices, remain vigilant for suspicious communications, and stay informed about the latest developments as the investigation unfolds.