Hackers lurked in Revolut systems for five months, demand $3 million ransom

Hackers targeting Revolut demanded a $3 million ransom after siphoning sensitive data by impersonating a government agency via a spoofed email domain.

 

Last week, Revolut started notifying its customers of a data security incident after the company exposed customer data to a third party following fraudulent requests from a spoofed government email.

 

According to reports, the confidential information shared with the perpetrators comprised extensive personal and financial data, including names, dates of birth, occupations, residential addresses, email addresses, and phone numbers. The information also reportedly included copies of identity documents, such as passports and driver’s licences, along with facial verification images. 

 

In addition, sensitive financial records—including IBANs, account statements, withdrawal records, and complete transaction histories, including Bitcoin transactions—were reportedly exposed.

 

A company spokesperson said only a small number of customers were affected. Revolut added that it blocked the email address once the scam was identified, notified the relevant authorities and regulators, and confirmed that its systems and customer funds remain unaffected.

 

 

A threat actor using the alias “IAmNotAVillain” has claimed responsibility for the data security incident involving Revolut and listed the company as a victim on the dark web. The actor has reportedly demanded a $3 million ransom and threatened to sell the entire stolen database if the demands are not met.

 

The fintech giant, howevevr, said it has not not received any “direct contact or demand from the individuals or group making these claims.”

 

According to reports publsihed by the cyber threat intelligence and research division of Hudson Rock, Duel investigations team, Revolut responded to the fake government requests for roughly five months through sending fraudulent data requests. 

 

“The hacker gained access to government employee accounts using an infostealer. After gaining entry to an employee’s email, they would log in, add a recovery email under their control, begin logging activities, and silently monitor communications,” researchers noted.

 

The hackers said it deleted fraudulent emails and monitored the compromised inbox, saving and removing replies as .eml files before the account owner could see them. They initially considered forging court orders but instead targeted Lithuania-based Revolut Bank UAB, which must respond to European Investigation Orders. Over five months, Revolut reportedly processed the hacker’s repeated requests without scrutiny; in one case, support staff allegedly helped correct an incorrect document instead of detecting the fraud.

 

 

The hackers now claim to have obtained more than 147GB of data from an Italian law enforcement agency through Revolut, with the matter reportedly under investigation by Italian police.