Revolut says no direct demand received over alleged data breach

Revolut Denies Receiving Direct Ransom Demand After Customer Data Breach

Revolut Responds to Data Breach and Ransom Claims

Sept 16 (Reuters) - Revolut has had no direct contact or demand from the individuals or group claiming responsibility for a data breach, a company spokesperson told Reuters on Wednesday.

Attackers' Ransom Threats and Media Reports

The Financial Times reported that attackers claiming responsibility for a data breach at the company had threatened to sell confidential records of hundreds of customers to other criminal groups unless Revolut paid a $3 million ransom within 24 hours.

Key Details of the Revolut Data Breach

Extent of the Breach

Here are some details: 

• Revolut's core infrastructure, databases and customer accounts were not hacked, a source familiar with the matter said.
• The breach is understood to have affected about 680 customers, according to the source.

Identity and Actions of the Attacker Group

• The group, which calls itself iamnotavillain, published the ultimatum online on Wednesday afternoon next to a digital countdown clock, the FT report said.
• The group told the newspaper it was using the website to make its demands for the first time and that there had not been any negotiations with Revolut.

How the Breach Occurred

• Revolut said on Saturday that sensitive customer information was disclosed to an unauthorized third party after it received fraudulent requests from a legitimate government agency email domain.

Reporting Credits

(Reporting by Gnaneshwar Rajan and Preetika Parashuraman in Bengaluru; Editing by Vijay Kishore and Tasim Zahid)