Revolut says no direct contact after $3 million public ransom demand

The recent data breach affecting Revolut has escalated into a convoluted situation, marked by conflicting claims and public ransom demands. Revolut, a prominent fintech firm, has publicly stated that it has not received any direct communication from those claiming responsibility for the customer data compromise, despite several groups making their demands known through public channels. This lack of direct contact adds a layer of uncertainty to an already serious security incident, making it difficult for the company to ascertain the legitimacy or true identity of the actors involved. The situation is further complicated by the involvement of Italian authorities, who are now investigating the alleged use of a government email account in the breach, suggesting a potentially broader and more sophisticated attack vector than initially perceived.

IAmNotAVillain

A group identifying itself as "IAmNotAVillain" has publicly demanded 6,000 Monero (XMR), valued at approximately $3 million, from Revolut. This ultimatum was issued with a strict 24-hour deadline, accompanied by threats to sell the compromised customer records to other criminal entities if the demand was not met. The group's website, iamnotavillain.xyz, was reportedly unavailable at the time of Cointelegraph's publication, adding to the ambiguity surrounding their operations and current status. Their public declaration and specific monetary demand in a privacy-focused cryptocurrency like Monero indicate a calculated attempt to pressure Revolut while maintaining a degree of anonymity.

IAmNotAVillain also actively disputed claims from a rival group, alleging that a former associate had only a small sample of the data and was falsely taking credit for the entire breach. This internal conflict among alleged perpetrators further muddies the waters for Revolut and investigators, making it challenging to determine who genuinely possesses the stolen data and who is merely attempting to capitalize on the incident. The public warning against dealing with the rival claimant underscores the competitive and fragmented nature of the cybercrime landscape.

Revolut Smilik

Prior to the demands made by IAmNotAVillain, another group operating under the name "Revolut Smilik" reportedly issued a significantly larger ransom demand. This group sought 10,000 Bitcoin, which at the time of their claim was estimated to be worth around $780 million. The vast disparity between this demand and the subsequent $3 million Monero request highlights the chaotic and uncoordinated nature of the ransom attempts. Such a substantial difference in demanded amounts could indicate varying levels of access to the stolen data, different motivations, or simply opportunistic attempts by unrelated parties.

The existence of multiple claimants, including a third actor associated with the website revoloot.lol flagged by Dark Web Informer, suggests a fragmented landscape of individuals or groups attempting to profit from the Revolut data breach. This fragmentation makes it exceedingly difficult for Revolut to verify the authenticity of any single demand or to engage in negotiations, even if they were inclined to do so. The competing claims and public disputes among these groups create a complex challenge for both the affected company and law enforcement agencies trying to unravel the incident.

Italian authorities

Italian authorities have significantly escalated their involvement in the Revolut data breach investigation, with the National Anti-Mafia and Anti-Terrorism Directorate now participating. This heightened level of scrutiny stems from the suspected intrusion concerning a government entity, specifically an alleged compromise of an institutional email account used to obtain customer data. Prosecutors in Reggio Calabria have initiated an investigation into unauthorized access to a computer system of public interest, indicating the serious nature of the breach and its potential implications beyond just Revolut's customers.

Investigators are actively working to determine whether the government email account was directly breached or merely cloned, a distinction that could significantly impact the scope and direction of the ongoing probe. Italy's privacy regulator has also taken action, urging banks to urgently review the security of their access systems and examining whether other financial institutions might have been affected. This broad regulatory response underscores the potential systemic risks posed by such a breach, particularly if it exploited vulnerabilities within public infrastructure or affected multiple financial entities.