The hackers who claim responsibility for the Revolut data breach have told the Financial Times that they obtained personal details from 680 high-net-worth crypto accounts at the firm, and have described a method that is an escalation rather than a restatement of the 11–14 September disclosure. They say they compromised an Italian government email system and then exchanged messages with the bank over several months while posing as law enforcement, repeatedly requesting confidential account details for named customers — addresses, phone numbers and transaction histories — on the basis that the information was needed for ongoing investigations. Messages the hackers shared with the FT appeared to show Revolut exchanging customer account information with an arm of Italy's interior ministry through La Posta Elettronica Certificata (PEC), the certified-email network overseen by a government agency that functions as the digital equivalent of registered post. The target selection is the most notable technical claim: the group says it used blockchain analysis to identify Revolut accounts holding significant crypto assets, meaning the victims were chosen for the size of their holdings rather than harvested at random. Most of the 680 are said to be in Switzerland and France, with data on residents in a further 31 mainly European countries, including the UK, Germany and Spain. The hackers have set up a website and begun posting redacted screenshots of information allegedly obtained, and are reported to be ready to release more unless a ransom is paid; Revolut insists it has not been contacted by the perpetrators and has yet to receive a ransom demand. The company confirmed the underlying breach on 11 September, saying the request carried valid domain authentication credentials and was fulfilled "under the reasonable belief that it was an authentic government agency request".

• Source article

Escalation — 17 September 2026: extortion deadline set as UK and Italian regulators open files

Revolut says it has received no direct contact from the group calling itself IAmNotAVillain, which published a countdown demanding 6,000 Monero — about US$3 million — and threatened to sell customer records it claims to hold from the breach. The regulatory footprint is the material change: the UK ICO has an open investigation, Italy's National Anti-Mafia and Anti-Terrorism Directorate is involved because a government mailbox is implicated, and prosecutors in Reggio Calabria have opened a probe into unauthorised access to a computer system of public interest. Reuters and the FT report that the competing claimants dispute which of them holds the data, so the volume claim should be read as a negotiating position rather than a measured figure. Revolut says its systems and customer funds are unaffected, and that it alerted government, law enforcement, data protection and financial regulators once the fraudulent Italian government domain was identified.

• The Guardian — Revolut reportedly facing $3m ransom demand