Now, the U.K. FinTech is dealing with extortion threats from a hacker claiming to have perpetrated the breach, the Wall Street Journal (WSJ) reported Tuesday (Sept. 16).
According to this report, the hacker has released bits of stolen customer data and threatened to reveal more unless Revolut pays a ransom.
Revolut told the WSJ it had alerted law enforcement, but declined to comment further on the extortion threat. The U.K. Information Commissioner’s Office, which handles data protection, said it was investigating, the report added.
Revolut notified customers last week that their information had been exposed in a scam in which an unauthorized third party used a legitimate government email domain. Revolut said it had blocked the address after learning of the scheme and notified authorities.
“Revolut systems and customer funds are unaffected,” a Revolut spokesperson told Bloomberg News via email. “We have contacted the limited number of impacted individuals directly to inform them and provide support.”
A source close to the company told the WSJ that around 680 people were impacted, a miniscule fraction of Revolut’s 80 million customers.
However, the report says the incident has attracted scrutiny as it appears to have targeted some high net worth members of the digital asset space. According to the WSJ, some of these people now worry they’ll be targeted in “wrench attacks,” where criminals use threats of violence to force bitcoin investors to turn over the digital keys to their cryptocurrency.
Since the breach, a hacker calling themselves “I Am Not A Villain” has released materials mistakenly handed over by Revolut, the report said.
“We’re gonna start releasing more and more data everyday until revolut [sic] pays for leaking their customers,” I Am Not A Villain wrote in a post on a Telegram channel that has since been deleted but was first archived by cybersecurity researchers.
Scammers have long posed as government agencies to send fake law-enforcement requests, and these tricks aren’t especially difficult, said Conor Freeman, an Irish cybersecurity researcher who has been following the Revolut hack.
“It’s not exactly rocket science,” Freeman told the WSJ.
Research by PYMNTS Intelligence from the report “Financial Scams and Consumer Trust” found that 81% of successful scams are impersonation scams in which criminals pretend to be trusted authorities, friendly strangers or personal contacts.
“Scammers exploit trust across all communication channels, from phone calls and email to social media and online ads,” the report said. “These criminals overwhelmingly rely on impersonation tactics, a threat that will only grow as AI technologies evolve.”
