Skip to content
Revolut Data Breach: Hackers Demand $3 Million Ransom in Monero

Revolut Data Breach: Hackers Demand $3 Million Ransom in Monero

First seen 19 Sep 2026, 20:53 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster September 20, 2026 at 19:58 UTC
  • Hackers stole data from 680 Revolut customers by impersonating law enforcement.
  • A ransom of 6,000 Monero ($3 million) was demanded within 24 hours.
  • Italian authorities are investigating the sophisticated attack involving a government email compromise.

A group of hackers named 'iamnotavillain' has targeted Revolut, stealing sensitive data from approximately 680 customers by impersonating Italian law enforcement. The attackers used a compromised email account from an Italian government agency to request personal information, including passports and transaction histories, over several months. They demanded a ransom of 6,000 Monero (about $3 million) within 24 hours, threatening to sell the data if not paid. Italian prosecutors have launched an investigation, involving anti-mafia and counterterrorism units, due to the sophisticated nature of the attack. Revolut has confirmed that its core systems were not breached, but the incident raises significant concerns about customer data security. The attackers reportedly used blockchain analysis to identify high-net-worth individuals as targets. The ransom demand was made public, which is atypical for such operations. As of now, there is no confirmation of whether Revolut has paid the ransom or engaged in negotiations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Timeline

2026-09-12
Revolut confirms data disclosure
Revolut notified affected customers about the data breach involving sensitive personal information.
247wallst.com
2026-09-16
Ransom demand published
The hacker group publicly demanded 6,000 Monero, threatening to sell the stolen data if not paid.
Commstrader
2026-09-19
Investigation launched
Italian prosecutors opened an investigation into the extortion campaign and data breach.
Ca.Finance.Yahoo

More articles in this cluster (5)

Following this threat?

Track Italy's Interior Ministry in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed