Revolut Faces $3M Monero Ransom Demand After Customer Data Breach

Revolut confirmed Thursday that it has received no direct contact from threat actors claiming responsibility for a recent customer data breach, despite multiple public ransom demands totaling millions in cryptocurrency. The fintech giant disclosed the breach last week, and the situation has since escalated with competing groups issuing separate extortion demands and Italian authorities expanding their investigation.

The most recent demand came from a group calling itself "IAmNotAVillain," which publicly demanded 6,000 Monero (XMR), worth approximately $3 million, within 24 hours, threatening to sell stolen customer records to other criminal networks, according to the Financial Times. A Revolut spokesperson told Cointelegraph: "Revolut has not received any direct contact or demand from the individuals or group making these claims." The group's website, iamnotavillain.xyz, was offline when checked at publication time. Complicating matters, a separate group calling itself "Revolut Smilik" had previously demanded 10,000 Bitcoin (BTC), worth roughly $780 million, while cybersecurity account Dark Web Informer flagged yet another site, revoloot.lol, linked to a different actor also claiming responsibility.

IAmNotAVillain disputed the competing claims, alleging in a notice on its site that a former associate had received only a small sample of the data before falsely taking credit for the breach, and warned others not to negotiate with the rival claimant. The fragmented claims have left uncertainty over who actually controls the stolen records.

Italy's National Anti-Mafia and Anti-Terrorism Directorate has joined the probe because the suspected intrusion involves a government email account allegedly used to obtain customer data. Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest, raising the stakes significantly beyond a typical corporate breach.