Revolut hackers demand 6,000 XMR as Italy opens data probe

Italian prosecutors have opened an investigation after criminals allegedly used a compromised government email account to obtain information about hundreds of Revolut customers.

The group that claimed to be behind it demanded 6,000 Monero [XMR], worth about $3 million. The deadline they set has passed, but it is not known if Revolut paid or not, or if the data has now been sold as they threatened.

Hackers allegedly targeted crypto holders

The ransom demand was unveiled with a 24-hour countdown by the group, which calls itself “iamnotavillain”, on September 16.

According to the Financial Times, the attackers threatened to sell sensitive customer records to criminals if Revolut did not pay.

Several passports, driving licenses, identity photographs, and transaction histories were all visible on screen in a video that the FT watched. At least 680 customer accounts have been compromised.

The attackers said that they identified customers with a lot of crypto holdings by doing blockchain analysis. They said they got the records after they compromised an Italian government email system and acted as if they were law enforcement officials.

Revolut responded by stating they had not formally heard back from the group nor received any ransom demands. They confirmed that none of its internal nor client funds had been affected nor breached.

Revolut has said that they have been working closely with other regulators and law enforcement bodies, and have also offered to help and support any of its affected customers.

Italian prosecutors and the country’s anti-mafia and counterterrorism authorities are now investigating the incident, according to an updated Euronews report.

Why the attackers demanded Monero

Monero hides information that most public blockchains display, including transaction amounts and the identities of senders and recipients.

These protections offer financial privacy to ordinary users. Yet, they also provide an appealing option for criminals seeking to hide ransoms.

This incident implies in no way that the Monero network itself was breached and implicated in obtaining the customers’ records; XMR was employed by the attackers as their chosen method of payment.

XMR was trading near $546 when writing, up by more than 5.7% from opening. XMR jumped above $600 for a few minutes but has dropped from those levels.

​Yet while the price remained above its recent average, the massive wick from $608 showed that sellers were not playing around when the price rose to a certain level.

Final Summary

• After allegedly leaking the records of at least 680 customers, the attacker[s] demanded payment of 6,000 XMR!
• Revolut’s systems and customers’ funds were said to still be secure, while it is not clear what happened after the ransom demand time expired.