Imnotavillain

Parties claiming responsibility for the breach have posted samples of the allegedly stolen data across several Telegram groups, reported to include details belonging to "prominent individuals, including business leaders, sports professionals and performing artists," and are demanding Revolut pay a ransom of 10,000 Bitcoin, worth more than 782 million US dollars at the time of reporting, threatening to publish further data "every day" if unpaid (DataBreaches.net, relaying Computing.co.uk, 2026-09-15). This is the first extortion dimension reported on an incident this entry previously described only as a disclosed process-abuse breach with no stated attacker demand. Computing.co.uk, the outlet that originated this reporting, remains unreachable on every transport tried as of 2026-09-16; neither Revolut nor a second independent outlet has confirmed the ransom figure, the Telegram posting, or the claimed victim identities, so these remain attacker-stated claims rather than established fact.

Hudson Rock, relaying the attacker's own account to the Duel Investigations Team, reports the access vector claimed behind the fraudulent request: infostealer-compromised webmail accounts on pec.interno.it, the certified-email domain of Italy's Ministry of the Interior. Per that account, the hacker gained access to government employee accounts using an infostealer, and after gaining entry to an employee's email, would log in, add a recovery email under their control, begin logging activities, and silently monitor communications (The Duel Investigations Team, via Hudson Rock, 2026-09-15). Upon receiving a reply to their fraudulent emails, the operator would immediately download it as a .eml file and delete it before the actual account owner noticed, an anti-forensic technique the account says let the campaign run for roughly five months, beginning with forged court orders before pivoting to Revolut Bank UAB, Revolut's Lithuania-licensed EU subsidiary obligated to respond to European Investigation Orders (The Duel Investigations Team, via Hudson Rock, 2026-09-15). Hudson Rock's own cybercrime database independently identified approximately 300 compromised pec.interno.it webmail logins from already-infected machines, and on that basis assesses it is highly unlikely the hacker actively infected these specific employees themselves (Hudson Rock, 2026-09-15); the attacker's own account of the initial-access method was itself inconsistent, first describing a remote-access trojan and later an infostealer. This resolves the access-vector question the original disclosure left open; CyberInsider reports Revolut told it only that the fraudulent request "appeared authentic based on the technical indicators available to its staff" (CyberInsider, 2026-09-16), and Revolut itself has not confirmed the five-month timeline, the pec.interno.it detail, or the anti-forensic technique. CyberInsider separately references unnamed "separate reporting" giving a customer count of around 680, a figure this entry cannot independently verify.

The Irish Times independently confirms the customer count this entry previously could not verify: "The data breach is understood to have affected at least 680 customer accounts" (The Irish Times, 2026-09-17), reporting on a group spelling its name "iamnotavillain." A group whose name Heise Online spells "Imnotavillain" now claims sole responsibility for the breach on its own darknet site, disputing a rival claimant it says "took only part of the obtained data" and "is posing as the actual perpetrator" while calling that rival "a fraud" (Heise Online, 2026-09-25, translated from German); no cited source explicitly states the two spellings name the same actor, and neither claimant's identity is independently established. Having already issued a 6,000 XMR ($3 million) ransom ultimatum to Revolut itself with a 24-hour deadline, published on its own website with a countdown clock (The Irish Times, 2026-09-17); no cited source states what happened when that deadline passed, a separate, larger 10,000 Bitcoin demand this entry's 2026-09-16 update recorded came from a single, since-unreachable relay and is not corroborated by this Irish Times reporting or any other cited source, and the two figures are not reconciled here; a group under this name has now pivoted to individually extorting the roughly 680 named customers directly: it is "offering the data sets of 680 high-ranking individuals for sale" and letting each "buy the removal of their own record before the data is sold as a whole to interested parties in the future," publishing sample records including full name, email, phone number, address, account IDs, crypto withdrawal and balance data, bank transactions, and KYC documents and selfies as proof (Heise Online, 2026-09-25, translated from German). Revolut itself told the Irish Times at the time of the original ultimatum that it "has not received any direct contact or demand from the individuals or group making these claims" (The Irish Times, 2026-09-17); neither Revolut nor an independent researcher has confirmed either claimant's identity or the completeness of the data set.