Back Techflowpost

Revolut Targeted by Multiple Ransomware Groups, Claims It Has Not Received Any Direct Contact

Techflowpost • September 17, 2026

According to TechFlow, on September 17, Cointelegraph reported that following a customer data breach at Revolut, multiple hacker groups have publicly demanded ransoms. The organization claiming to be "IAmNotAVillain" demanded that Revolut pay 6,000 Monero (XMR, approximately $3 million) within 24 hours, threatening to sell customer data to other criminal groups if unpaid; another group calling itself "Revolut Smilik" had earlier demanded 10,000 Bitcoin (approximately $780 million).

In response, a Revolut spokesperson stated that the company had not received any direct or extortion demands from the aforementioned individuals or organizations. Meanwhile, Italy’s Anti-Mafia and Counter-Terrorism Directorate has intervened in the investigation, Italian prosecutors are probing unauthorized access to government computer systems, and Italy's data protection authority has also ordered banks to urgently review their system access security.

TechFlow Selected More>

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Revolut Data Breach Linked to Compromised Italian Government Email A significant data breach at Revolut involved hackers impersonating Italian law enforcement to obtain sensitive customer information. The attackers exploited a compromised Italian government email account, specifically from the pec.interno.it domain, to submit fraudulent requests for data. Approximately 680 customers were affected, with data including identity documents, banking information, and transaction histories being exposed. Revolut confirmed that its systems were not breached and that the requests appeared legitimate due to the email domain's authenticity. The attackers, identified as the group 'IAmNotAVillain', claimed to have maintained access to the compromised email account for about six months. The incident raises serious concerns about the security of government email systems and the potential for similar attacks in the future. Revolut has since alerted affected customers and blocked the fraudulent email address. Investigations are ongoing, and the incident has drawn attention from various regulatory bodies. 42 sources 68

Extracted Entities

Revolut Targeted by Multiple Ransomware Groups, Claims It Has Not Received Any Direct Contact

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Countries (1)