Revolut Faces Extortion Threat After Data Breach Affecting 680 Customers
A hacking group calling itself iamnotavillain has publicly demanded a $3 million ransom from Revolut, threatening to sell the stolen data of approximately 680 customers if the digital bank fails to pay within 24 hours. The ultimatum, posted on the group’s website alongside a countdown timer, marks an unusual departure from typical ransomware tactics, which usually involve private negotiations before escalating to public leaks.
The hackers, who communicated with the Financial Times via Telegram, provided redacted screenshots and a 60-second video allegedly showing compromised customer data, including passports, driving licenses, identity verification images, and transaction histories. The breach appears to have targeted accounts with significant cryptocurrency holdings, identified through blockchain analysis.
According to reports, the attackers gained access by compromising an Italian government email system, impersonating law enforcement to request customer data from Revolut over several months. Revolut stated it had not received direct contact from the group but confirmed it was assisting affected customers and collaborating with authorities.
The fintech giant, valued at $115 billion and serving 80 million customers across 30+ countries, has not disclosed further details on the breach’s scope or response. The incident underscores growing risks of supply-chain attacks and law enforcement impersonation in cybercrime.
Revolut cybersecurity rating report: https://www.rankiteo.com/company/revolut
"id": "REV1789641174",
"linkid": "revolut",
"type": "Breach",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '680',
'industry': 'Financial Services',
'location': 'Global (Headquartered in UK)',
'name': 'Revolut',
'size': '80 million customers',
'type': 'Fintech, Digital Bank'}],
'attack_vector': 'Supply-chain attack, Law enforcement impersonation',
'customer_advisories': 'Assisting affected customers',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '680',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Passports',
'Driving licenses',
'Identity verification images',
'Transaction histories']},
'description': 'A hacking group calling itself *iamnotavillain* has publicly '
'demanded a $3 million ransom from Revolut, threatening to '
'sell the stolen data of approximately 680 customers if the '
'digital bank fails to pay within 24 hours. The breach '
'involved compromised customer data, including passports, '
'driving licenses, identity verification images, and '
'transaction histories, targeting accounts with significant '
'cryptocurrency holdings.',
'impact': {'brand_reputation_impact': 'Potential reputational damage',
'data_compromised': 'Passports, driving licenses, identity '
'verification images, transaction histories',
'identity_theft_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Threatened',
'entry_point': 'Compromised Italian government '
'email system',
'high_value_targets': 'Accounts with significant '
'cryptocurrency holdings',
'reconnaissance_period': 'Several months'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Supply-chain attack, law '
'enforcement impersonation'},
'ransomware': {'data_exfiltration': 'Yes', 'ransom_demanded': '$3 million'},
'references': [{'source': 'Financial Times'}],
'response': {'communication_strategy': 'Assisting affected customers, '
'collaborating with authorities',
'law_enforcement_notified': 'Yes'},
'threat_actor': 'iamnotavillain',
'title': 'Revolut Faces Extortion Threat After Data Breach Affecting 680 '
'Customers',
'type': 'Data Breach, Extortion',
'vulnerability_exploited': 'Compromised Italian government email system'}