Hackers compromised a government employee's email account via an infostealer infection and used it to send fraudulent requests impersonating an Italian government agency to Revolut Bank UAB, a subsidiary of Revolut. Over roughly five months, Revolut responded to these requests without verifying their authenticity, resulting in the exposure of personal and financial information of about 680 customers, including cryptocurrency whales. The threat actor, known as 'IAmNotAVillain,' publicly demanded a $3 million ransom and threatened to sell the data. The breach also involved theft of 147GB of data from an Italian law enforcement agency. Investigations suggest the attackers likely used purchased or existing infostealer logs for initial access rather than directly infecting employees. Italian police have launched an investigation.

The breach compromised sensitive personal and financial information, including passports, email addresses, phone numbers, and financial data, of approximately 680 high-profile Revolut customers. The exposure of such data poses risks of identity theft, financial fraud, and privacy violations. The attackers also obtained a large volume of law enforcement data (147GB), potentially impacting public safety and law enforcement operations. The ransom demand and threat to sell the data indicate potential further exposure and exploitation.

No official vendor advisory or patch information is available. As this breach involved social engineering and fraudulent legal requests, mitigation should focus on strengthening verification processes for legal and government requests. Revolut and similar organizations should implement stringent validation of such requests before compliance. Monitoring and securing government employee accounts to prevent compromise is also critical. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.