Revolut hack: criminals steal data of 700 European clients, demand $3m ransom

An investigation has been launched by the public prosecutor's office in Reggio Calabria into a hacking incident targeting Revolut, the London-based banking services company. A group of cybercriminals, calling themselves "iamnotavillain," requested sensitive data from a compromised institutional email account belonging to the Reggio Calabria prefecture.

According to the Financial Times, the hackers demanded a ransom of $3 million (2.61 million euros) from Revolut, threatening to sell the stolen data to other criminal organizations if the ransom was not paid within 24 hours.

The hackers posted the ransom demand on their website on the dark web, making it unusual as ransom demands are typically made privately at first. The cybercriminal group claims this is the first time they have used their site for a ransom demand and that they have not yet contacted Revolut to negotiate. The information stolen includes passport details, driving licence data, other identity documents, and photographs, totaling 147 gigabytes of data.

Prosecutors are considering the offence of intrusion into an IT system of public interest, with an initial report indicating that the operation, which lasted for months, was highly sophisticated. It remains unclear whether the compromised account belonged to the Reggio Calabria prefecture or Italy's Interior Ministry. The Italian data protection authority has launched checks for possible security breaches at Italian banks and urged data-protection officers to review and report any vulnerabilities found.