Europe’s largest financial technology company confirmed it had fallen victim to an impersonation scam last week
Revolut is facing a reported $3m (£2.2m) ransom demand after hackers posing as government officials accessed the data of hundreds of the bank’s cryptocurrency customers, including one victim who says he fears for his safety.
Europe’s largest financial technology company confirmed last weekend that it had fallen victim to an impersonation scam in which hackers compromised an Italian government email system to contact Revolut staff and request personal customer details.
While the data breach only affected about 680 of Revolut’s 80 million global customers, it is believed to have targeted customers with suspected cryptocurrency holdings.
It is not how the scandal might affect Revolut’s much-anticipated stock market debut, with Revolut’s founder, Nik Storonsky, Les Echoes on Thursday that there were plans for a dual listing in both London and New York.
One of the alleged hackers has reportedly threatened to publish the customer data unless Revolut pays a $3m ransom, according to the Financial Times, which has been speaking to the purported hacker. A Revolut spokesperson said the bank “has not received any direct contact or demand from the individuals or group making these claims”.
But some victims have said they fear they could end up being forced to face ransoms.
The former chief executive of failed bitcoin exchange Mt. Gox, Mark Karpelès, said he was one of the victims of the data breach and is now worried about his family’s safety. “I have kids, we’re living together. My address is in those files, so of course I’m worried about this,” he told the Guardian.
He has since contacted law enforcement in Tokyo, where he lives, after saying in a X post earlier this week that he feared he could be “kidnapped or dead” by the time Revolut gave him information about the breach.
Karpelès said he was relieved that Japanese officials were taking the threat seriously, “but I might still have to travel overseas or be in places that may not be as safe”.
The French business owner, who has been a Revolut customer since 2023, said that hackers may have mistakenly targeted his account, thinking he was wealthier than he is. He said he was forced to declare bankruptcy in the wake of a high-profile court case in Japan.
Karpelès is a figure in the crypto world. He was charged, but later acquitted, of embezzlement by Japanese courts, following the collapse of the crypto exchange platform in 2014. He was found guilty of falsifying data.
Karpelès said he has joined a victim chat group on X in the wake of the data breach, where customers having been sharing information and support. “We’re all in the same situation, which is: we don’t know exactly what happened, or how it happened, so we’re trying to get as much information as possible,” he said. He added that one of the victims got in touch with the purported hacker, who showed they had the victim’s personal details on hand.
The hacker then said they would delete the information, but only if they were sent $50,000, Karpelès said.
While Karpelès was frustrated with Revolut, which was valued at $115bn in a secondary share sale earlier this summer, he does not believe the bank should pay the $3m ransom, which gives no guarantee that the data will be deleted.
It is still not how many hackers are involved, and requests for the ransom to be paid through a platform known as Monero, meaning there would be no evidence or receipt of payment, allowing the hacker to claim they never received the money in the first place.
Karpelès hopes Revolut will share more information about the breach.
“This is very, very damaging [for the Revolut brand] because I do believe a lot of Revolut customers are more likely to be privacy sensitive,” he said, noting that this was usually a high priority among people invested in cryptocurrencies.
A Revolut spokesperson said:“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a government agency domain email to submit fraudulent requests for information.
“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators. Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support.”