Key Takeaways:
- The hackers are asking for 6,000 XMR (around $3 million) from Revolut.
- Data allegedly connected to approximately 680 customer accounts was reportedly stolen in the breach.
- Aggressors state they identified the customers with significant crypto stashes by analyzing the blockchain.
The hackers behind the Revolut breach have threatened to sell data to other criminal groups if they don’t receive the 200 Bitcoins they call for within 24 hours.
Read More: Revolut Exposes Bitcoin Records, Passports After Fraudulent Government Email Attack
Hackers Demand 6,000 XMR
The group, calling itself iamnotavillain, published its demand online alongside a countdown clock, according to the Financial Times. It requested 6,000 XMR, which was valued at roughly $3 million at the time of the report.
They opted for Monero, which is notable in an extortion case on the cryptocurrency front. Unlike the Bitcoin network, where transactions can be viewed openly on-chain, Monero is built to offer more privacy during transactions.
According to the Financial Times, the hackers stated that there was no communication with Revolut up to the time of the demand’s publication. They also posted a brief video clip which appeared to be a screen shot of the customers data that was allegedly gathered during the incident.
Read More: Revolut Crypto Data Leak Exposes Bitcoin Records, Attackers Demand Payment to Stop More
Around 680 Customer Accounts Affected
Revolut has stated that the incident didn’t involve a direct breach into their core system, databases or customers accounts. In lieu, attackers allegedly made fake requests by utilizing an email application connected to a real government entity.
The requests included information requests as official business requests. Revolut then handed over records prior to determining that they were fraudulent.
The exposed material reportedly included passports, driving licences, identity-verification images and transaction histories. Additional information in some records were linked to customers’ cryptic transactions.
Revolut blocked the address, and informed the appropriate government body, law enforcement, and the regulator.
Crypto Holdings Helped Attackers Pick Targets
The alleged use of blockchain study introduces a strange crypto element into the breach. The hackers reportedly analyzed blockchain transactions to uncover the users of Revolut who were suspected of having large crypto holdings.
While a public blockchain might show wallet activity and transaction flows, much more information from an exchange or financial service may be necessary to link a blockchain address to a person.
Closed for this one, the mix of blockchain transactionings and customer records may offer an attacker with crystal-clear data of the user’s identity and crypto assets. The source has not been verified by others for the details regarding target selection.
Revolut Rejects Direct Ransom Contact
There was a disconnect between what the attackers announced and what Revolut reported, with the company saying it did not receive direct contact nor intended to pay any ransom from the group claiming responsibility.
The company said affected customers were being supported, and issued the description as a result of an external impersonation scheme.
The leaked data led to a specific concern that faces any crypto’realm user: personal identity data can, when merged with blockchain-related financial details, be particularly useful. This information can be leveraged for targeted phishing, impersonation or further attempts to access digital assets.
