Revolut hackers demand $3m amid threats to release sensitive data

Hackers, calling themselves iamnotavillain, have demanded $3 million from payment platform Revolut, threatening to release stolen customer data if their ransom is not paid. Revolut confirmed on Saturday (12 September) that unauthorized individuals had accessed sensitive information, including names, birthdates, occupations, addresses, contact details, passports, driving licenses, financial statements, and facial verification images. Around 680 people, including 12 in Ireland, were affected by the data breach.

On Wednesday (16 September), iamnotavillain posted a digital countdown clock and a demand on their website, giving Revolut 24 hours to comply. The group subsequently sent a 60-second screen capture video to the Financial Times, showcasing a user navigating through the stolen documents. The message in the video demanded payment of $3 million, warning that all the data would be sold and the "blood will be on your hands" if the ransom wasn't paid.

The hackers have given Revolut a single day to meet their demands, or they will sell the compromised data to other cybercriminals. So far, there have been no negotiations between the group and Revolut. Meanwhile, Revolut has recently applied for a Swiss banking license, intending to invest over 150 million Swiss francs in Switzerland over the next five years to create jobs and support product development.

The company already has a full banking license in France, making it a prominent player in Europe's fintech landscape with over 75 million customers globally.