In early 2024 a cyber‑crime group that had previously claimed responsibility for a series of high‑profile data breaches turned its attention to Revolut, the fast‑growing financial‑technology platform that offers banking, currency exchange and cryptocurrency services to millions of users worldwide. The group announced that it had exfiltrated a substantial amount of personal and financial information from Revolut’s systems and demanded a ransom of three million dollars, payable in the privacy‑focused cryptocurrency Monero (XMR).
In addition to the monetary demand, the attackers threatened to put the stolen data up for sale on underground markets if their demands were not met within a 24‑hour window. The public statement released by the group highlighted that they had specifically targeted Revolut accounts belonging to individuals with significant holdings in digital assets such as Bitcoin, Ethereum and other altcoins. By focusing on high‑value crypto users, the criminals aimed to maximise the leverage they could exert, assuming that these customers would be more willing to pay a ransom to protect their sensitive information and avoid potential financial loss. The demand for payment in Monero was a deliberate choice, as Monero’s built‑in privacy features make it considerably harder for law‑enforcement agencies to trace transactions compared to more transparent cryptocurrencies like Bitcoin.
Revolut’s official response was swift but measured. In a press release, the company said that it had not received any direct contact from the individuals or group claiming responsibility for the breach. Revolut emphasized that its security teams were actively investigating the incident, working closely with cyber‑security experts and relevant authorities to assess the scope of the compromise and to protect its customers.
The firm also reassured users that it had already implemented multiple layers of security, including two‑factor authentication, biometric verification and continuous monitoring of suspicious activity, to mitigate the risk of unauthorized access. While Revolut has not disclosed the exact number of affected accounts, analysts familiar with the situation suggest that the breach could potentially involve thousands of users, given the platform’s global reach of over 30 million customers. The stolen data is believed to include personal identifiers such as names, email addresses, phone numbers, as well as financial details like bank account numbers, transaction histories, and, critically, the cryptocurrency wallet addresses linked to users’ Revolut accounts.
If this information were to be sold on the dark web, it could enable a range of illicit activities, including identity theft, phishing scams, and targeted ransomware attacks. Cyber‑security experts warn that the threat of data being auctioned off is not merely a bluff. Past incidents involving similar extortion tactics have resulted in the public release of large data sets, causing long‑term damage to both individuals and organizations. For instance, the 2021 breach of a major cloud‑storage provider saw millions of records posted on a public forum, leading to a surge in credential‑stuffing attacks across the internet.
In the Revolut case, the attackers’ focus on crypto‑savvy customers adds another layer of risk, as the stolen wallet addresses could be cross‑referenced with blockchain analytics tools to trace transaction patterns and potentially facilitate theft of digital assets. The demand for a three‑million‑dollar ransom in Monero raises several legal and ethical questions.
Paying a ransom to cyber‑criminals is generally discouraged by law‑enforcement agencies because it can fund further criminal activity and does not guarantee that the data will be destroyed or that the perpetrators will not release it later. Moreover, the use of Monero complicates any attempt by authorities to track the flow of funds, potentially putting the paying organization at risk of violating anti‑money‑laundering (AML) regulations. In the broader context, the Revolut breach underscores the growing intersection between traditional financial services and the cryptocurrency ecosystem. As more fintech firms integrate crypto wallets and trading features into their platforms, they become attractive targets for threat actors who seek to exploit the higher value and relative anonymity associated with digital assets.
This trend has prompted regulators in several jurisdictions to call for stricter security standards and clearer reporting obligations for firms handling crypto‑related data. For Revolut customers, the immediate steps recommended by the company include changing passwords, enabling all available security features, and monitoring account activity for any unauthorized transactions. Users are also advised to be vigilant against phishing emails that may reference the breach, as attackers often use such incidents to craft convincing social‑engineering messages aimed at extracting further credentials.
The incident also serves as a reminder for all organizations that handle sensitive financial data to adopt a proactive security posture. Regular penetration testing, comprehensive encryption of data at rest and in transit, and rapid incident‑response planning are essential components of a robust defense strategy.
Additionally, maintaining up‑to‑date threat intelligence feeds can help detect emerging ransomware groups and their preferred ransom currencies, allowing companies to anticipate and mitigate potential extortion attempts before they materialize. As the investigation continues, the cyber‑security community will be watching closely to see whether the attackers follow through on their threat to sell the data, and how law‑enforcement agencies respond to a ransom demand made in a privacy‑centric cryptocurrency. The outcome may set a precedent for how future ransomware and data‑extortion cases are handled, especially those involving the rapidly expanding world of digital finance. In summary, a cyber‑crime group has claimed to have stolen a sizable trove of Revolut user data and is demanding a $3 million ransom in Monero, with a 24‑hour deadline and a warning that the data could be put up for sale.
Revolut has denied any direct contact from the perpetrators, is conducting an internal investigation, and is urging its customers to strengthen their security settings. The situation highlights the heightened risk faced by fintech platforms that blend traditional banking with cryptocurrency services, and it raises important questions about ransom payments, data protection, and regulatory oversight in an increasingly digital financial landscape.