Revolut Denies Direct Contact From Hackers Despite Public $3 Million Ransom Threat

Revolut said Thursday that no one claiming responsibility for its recent customer data breach has directly reached out to the company, even as public ransom demands continue to pile up online.

Multiple Groups, One Breach, Conflicting Claims

A group going by “IAmNotAVillain” had publicly demanded 6,000 Monero, worth close to $3 million, giving Revolut just 24 hours to pay or risk having customer records sold to other criminal groups, according to the Financial Times. A Revolut spokesperson pushed back on the seriousness of that threat, stating plainly that the company has not received any direct contact or demand from the individuals or group making these claims.

Complicating matters further, IAmNotAVillain isn’t the only party claiming credit. An earlier group calling itself “Revolut Smilik” had reportedly asked for a far larger sum, 10,000 Bitcoin, worth close to $780 million at the time. IAmNotAVillain pushed back against that rival claim on its own site, alleging the other group only had access to a small sample of data before falsely taking credit.

A separate website tied to yet another actor claiming involvement was also flagged by a cybersecurity monitoring account, though it too was unreachable when checked. Both of the earlier claimant sites were down at the time of reporting.

Italian Authorities Deepen Their Investigation

The breach, first disclosed by Revolut last week, reportedly stemmed from a fake government email used to access customer data. Italy’s National Anti Mafia and Anti Terrorism Directorate has now stepped in given the case involves a government entity, and prosecutors in Reggio Calabria have opened a formal probe into unauthorized access of a public interest computer system. Investigators are still working to confirm whether the official email account was hacked outright or cloned.

Separately, Italy’s data protection authority has urged banks to review their access security systems and is checking whether other financial institutions may have been affected.