Revolut says no direct contact from hackers after $3M public ransom demand

Revolut has told reporters it has not had any direct contact with individuals or groups claiming responsibility for a disclosed customer data breach, even though multiple public ransom demands have appeared online. One group calling itself IAmNotAVillain publicly posted an ultimatum demanding 6,000 Monero, which Cointelegraph cited as roughly $3 million, while an earlier claimant using the name Revolut Smilik asserted control and demanded 10,000 Bitcoin — a sum reported to be in the hundreds of millions of dollars.

The competing public claims and Revolut's statement that it has received no direct approaches have left uncertainty about who actually possesses the stolen records. IAmNotAVillain has disputed credit taken by the earlier claimant, asserting on its site that a former associate held only a small sample of the data and warning others not to engage with that rival. Cybersecurity observers also flagged an additional site, revoloot.lol, tied to a separate actor; Cointelegraph reported that the cited sites were unreachable at the time of checking.

Italian authorities have expanded their work into the matter because the apparent intrusion involves a government email account. Italy's National Anti-Mafia and Anti-Terrorism Directorate is now involved, and prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest. Investigators are working to determine whether the institutional email was breached or cloned, and the country's privacy regulator has asked banks to urgently review access security and to assess whether other financial institutions may be affected.

The public, conflicting extortion demands and the involvement of multiple investigative bodies underline challenges investigators face in attributing responsibility and assessing the scope of the incident. Revolut first disclosed the breach last week, and authorities and affected parties continue to probe how the data were obtained and who may hold or be attempting to monetize the records.