In a recent development that has sent shockwaves through the financial‑technology sector, an anonymous hacking collective announced that it had obtained a trove of sensitive data from Revolut, the popular UK‑based digital banking platform. According to the group’s public statement, the stolen information includes personal details of millions of users, as well as transaction histories that reveal the crypto‑asset holdings of high‑value customers.
The attackers have set a strict deadline of 24 hours for Revolut to meet their financial demands, demanding a payment of three million US dollars in the privacy‑focused cryptocurrency Monero (XMR). They warned that failure to comply would result in the immediate publication of the data on underground forums and the sale of the information to the highest bidder.
The claim appears to target Revolut’s rapidly expanding user base that increasingly relies on the app for buying, selling, and storing cryptocurrencies such as Bitcoin, Ethereum, and a host of altcoins. By focusing on customers with “significant crypto holdings,” the perpetrators aim to maximize the leverage of their ransom, knowing that large investors may be willing to pay a premium to keep their financial positions confidential.
The demand for Monero, a coin designed to obscure transaction trails, underscores the group’s intent to hide the flow of the ransom money and avoid detection by law‑enforcement agencies. Revolut’s official response to the incident has been cautious. In a statement released shortly after the claim surfaced, the company said it had not received any direct contact from the individuals or groups behind the alleged breach. The firm emphasized that it continually monitors its security infrastructure and works closely with cybersecurity experts to protect user data.
Revolut also reassured customers that it employs multiple layers of encryption and tokenisation to safeguard personal information, and that any compromise of data would be addressed swiftly and transparently. While Revolut has not confirmed the authenticity of the breach, the incident raises broader concerns about the security of fintech platforms that handle both fiat and digital assets.
Over the past few years, several high‑profile cyber‑attacks have targeted cryptocurrency exchanges and wallet providers, exploiting vulnerabilities in authentication systems, third‑party integrations, and even human error. The use of ransomware‑style demands—particularly in privacy‑centric cryptocurrencies—has become a common tactic for groups seeking to profit from the rapid growth of the digital‑asset market. Industry analysts note that the threat landscape is evolving.
Hackers are no longer satisfied with stealing funds directly; they now aim to harvest data that can be monetised in a variety of ways, from black‑mail and extortion to identity theft and fraud. In the case of Revolut, the alleged data set could contain names, email addresses, phone numbers, dates of birth, and possibly even government‑issued identification numbers. When combined with transaction records that reveal crypto balances, such data becomes a goldmine for criminals looking to craft targeted phishing campaigns or to sell the information on dark‑web marketplaces.
The demand for a Monero payment is particularly noteworthy. Unlike Bitcoin, where every transaction is publicly recorded on a blockchain, Monero employs stealth addresses, ring signatures, and confidential transactions to conceal the sender, receiver, and amount transferred. This makes it extremely difficult for investigators to trace the flow of funds once the ransom is paid. The choice of Monero suggests that the attackers are sophisticated enough to understand the advantages of using a privacy‑coin to evade detection.
Regulators in the United Kingdom and across the European Union have been increasingly focused on the security standards of digital‑banking services. The Financial Conduct Authority (FCA) requires firms to implement robust cyber‑risk management frameworks, conduct regular penetration testing, and maintain incident‑response plans. Should the alleged breach be verified, Revolut could face scrutiny from regulators, potentially leading to fines or mandated remedial actions.
For customers, the best defence remains vigilance. Users are advised to enable two‑factor authentication (2FA) on all accounts, use strong, unique passwords, and regularly monitor their transaction histories for any unauthorised activity. It is also prudent to limit the amount of personal data shared on the platform and to be wary of unsolicited communications that request additional verification details. In the broader context, the incident serves as a reminder that as financial services become more digitised, the attack surface for cyber‑criminals expands correspondingly.
Companies that blend traditional banking services with cryptocurrency functionalities must adopt a holistic security posture that addresses both fiat‑related and crypto‑related threats. This includes securing APIs, hardening cloud environments, and employing advanced threat‑intelligence tools that can detect anomalous behaviour in real time. As of now, the situation remains fluid. Revolut has not disclosed whether it is conducting an internal investigation or has engaged external forensic teams to verify the claims.
The company has also not indicated whether it will communicate directly with affected users, a step that could be essential for maintaining trust and complying with data‑protection regulations such as the General Data Protection Regulation (GDPR). In summary, a hacker group has publicly claimed to possess a substantial amount of Revolut’s user data and is demanding a three‑million‑dollar ransom in Monero, threatening to expose or sell the information if their demands are not met within 24 hours.
While Revolut denies any direct contact from the perpetrators, the episode highlights the growing intersection of traditional fintech services and cryptocurrency‑related cyber threats, underscoring the need for stronger security measures, regulatory oversight, and heightened user awareness. The outcome of this standoff will likely influence how other digital‑banking platforms approach data protection and ransomware preparedness in the months ahead.