- A hacker is offering what they described as data on 700 Revolut customers for $300,000.
- They claim to have IDs, passports, selfies, contact info, bank details, and transaction records.
- Revolut says its core systems were not hacked. The attacker used fake requests sent through a real government email channel.
A threat actor using the handle “IAmNotAVillain” is advertising data allegedly belonging to 700 Revolut customers on a cybercrime forum for $300,000.
The seller says the price can change, and they want payment in crypto. According to the listing, that data includes KYC files and identity documents. It also claims to include selfies used for account checks. There could be even more things like names, birth dates, phone numbers, emails, and home addresses.
The seller also claims to have bank data and money records. Those records may include bank details, transfers, deposits, and withdrawals. There’s also a claim that the data contains crypto activity.
There’s no evidence that the 700 records are from a complete and fresh customer database. The listing also does not prove that every file came from the Revolut case. This listing comes right after Revolut disclosed an incident that exposed user data to unknown parties earlier this month.
Details of the Revolut Breach
Revolut confirmed the data exposure on September 12, per a report from TechCrunch. The company said an unknown party stole customer data and sent fake requests from a real government email domain.
The requests looked like law enforcement requests. Revolut answered some of them and shared customer data before it found out it was fake and blocked the email address.
The company also contacted the affected customers. The leaked data may include names and birth dates. It may also include postal and email addresses, as well as phone numbers. Passports and driver’s licenses may also be part of the compromised information.
Revolut also warned that criminals may have obtained verification selfies, account statements, IBANs, and transaction records.
However, Revolut said its core systems and databases remain secure and untouched during the incident. were not hacked. Also, it says customer funds are safe.
So this was not a case of hackers breaking into the main bank database. The attack used a different path. The attackers appear to have tricked Revolut into releasing data through a trusted channel.
About 680 Customers Affected
The number of affected customers is now clearer. According to the Financial Times, Revolut tried to contact 680 customers. Later, Reuters quoted another source who gave this exact figure of 680.
The number matches the recent listing offering 700 Revolt customers for sale. It is unclear, however, whether these customers are the same.
The attackers also claimed that they carefully handpicked the victims. The Financial Times reported that claim. The group said it used blockchain analysis to find Revolut accounts with large crypto holdings. It called those customers “crypto whales.”
Most of the affected customers reportedly live in Switzerland and France. According to the Financial Times, the attackers also got their hands on customer data from 31 other European countries. As of now, nobody knows who these attackers are.
A Public Ransom Demand Followed
The $300,000 offer appears to be just a part of the attacker’s broader extortion strategy. Financial Times’ September 15 report noted the group demanded $3 million from Revolut to be paid in Monero. However, Revolut informed Reuters that it did not get a specific request. However, Revolut told Reuters it never received a direct demand.
The group placed a countdown beside the demand and said payment would stop the sale of the data. The deadline later passed with no public sign that Revolut paid the money. So, the group then turned its focus to the stolen data. It offered the alleged data for sale. It also began targeting individual customers, according to later reports.
A September 23 report said the group opened a leak site. The site showed records from a small number of customers. Those records reportedly included faces and identity documents as well as bank information. It’s worth noting that these are just reports from media and security sources. They do not prove that the full dataset exists.
Why the Data Could Be Dangerous
The alleged data goes far beyond basic contact details. A passport can help a criminal pose as another person. The same can happen with a driver’s license.
A selfie used for identity checks can add another layer. Also, a home address can create a physical safety risk. Bank records can show how a person moves money, and sometimes where they hold assets.
The exposure of banking information has also appeared in other alleged dark web data-sale claims. Cybercriminal claims sale of 2.3 million Brazilian bank records on dark web covers a separate claim involving millions of allegedly stolen bank records.
Crypto records can be even more sensitive; they can link a wallet to a real name and someone’s home address. That mix can make a victim a more attractive target. It could lead to scams or theft.
Security experts have warned about attacks on known crypto holders. Such attacks can happen after criminals learn a person’s identity and wealth. For now, there is no confirmed report that this has happened to a Revolut victim. Still, the risk is worth noting.
How the Attackers Got the Data
The attack method is one of the key parts of the case. The attackers did not need to break into Revolut’s main systems. Instead, they reportedly got access to an Italian government email account. They then used the account to send requests to Revolut.
The Financial Times reported that the requests used PEC, Italy’s certified email system. It handles official and legal messages in Italy.
The attackers posed as law enforcement and asked Revolut for data on specific customers. According to reports, the requests continued for several months. A person familiar with the case told the Financial Times that the requests came through PEC.
Italy’s data protection authority, Garante, is investigating the incident. The agency asked Italian banks to check for similar suspicious requests and review their security steps.
The U.K. The Information Commissioner’s Office has opened an investigation too, the Financial Times reported.
Many Details Remain Unconfirmed
A lot of details about the alleged Revolt data sale are still obscure. For one, there’s been no independent source to validate that all 700 records actually came from Revolut. The seller may be using the 700 figure to draw buyers. There’s also a possibility that they just mixed data from more than one source.
Moreover, there is no public proof that a buyer has paid the $300,000 asking price for the data. There is also no proof that the full dataset has changed hands.
For now, the offer should stay in the “alleged” category, not a confirmed data leak.
Still, the wider data exposure is real since Revolut has already confirmed that an unknown party got sensitive customer data.
The case also shows a risk for banks and other firms. A message can look official and still be fake. Attackers can also abuse a trusted email channel.
The new $300,000 claim adds another risk. It suggests that criminals may now try to profit from the data. The risks don’t usually end after the first exposure. Bad actors can use that leaked info to send convincing phishing messages to people and steal their money.
Revolut says it is working with affected customers to get things under control. It is also working with law enforcement and regulators to investigate the incident.
