The attack that tricked the British neobank and financial technology giant Revolut into disclosing the personal information of some of its customers late last week received a new and public demand on Wednesday, September 16: an official ransom demand with a 24-hour deadline.
Specifically, the group of attackers that calls itself ‘iamnotavillain’ requested roughly $3 million in Monero (XMR), a privacy-focused cryptocurrency, and stated it would begin selling the private information it obtained unless it gets paid within one day.
The demand was noted as unusual, as extortion attempts tend to be made publicly, per the reporting of the Financial Times. Additionally, the most recent developments seemingly contradict the Sunday rumors that the attackers wanted to be paid 10,000 Bitcoins (BTC), which Finbold conveyed in its original reporting of the incident.
Revolut attackers used an Italian government domain in the attack
Elsewhere, Revolut initially refused to disclose how many users were affected, simply noting that it directly contacted all the victims and, similarly, did not reveal the exact means by which it was tricked, instead saying that it was ‘a sophisticated external impersonation scam’ that involved an unauthorized party sending a request email from a genuine government domain.
More recently, it became known that the domain used in the cyberattack belonged to the Reggio Calabria prefecture – a region in the far south of the Italian mainland. The public prosecutor’s office for the relevant region also opened an inquiry into the incident.
Meanwhile, Revolut also reportedly disclosed that the information of 680 European customers was compromised but highlighted that their funds remain untouched.
ZachXBT, a popular online blockchain detective, speculated that the attack had a relatively small number of high-net-worth neobank clients as its target in a post on Telegram. Simultaneously, they revealed which data was affected:
Exposed data included:
-Copy of passport and/or driver’s licence, plus the verification selfie
-Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
-Full name, date of birth, occupation
-Home address, email, phone number
Lastly, no significant new information emerged by press time on September 17 about the attack itself, or how far the investigation of the Italian authorities – with support from their Lithuanian counterparts – has progressed.
Featured image via Shutterstock