Let’s go back to the cyber attack which involved over 680 Revolut customers, which became public knowledge only after the authors of the attack decided to claim it on a Telegram channel. The case caused particular outcry as it was perpetrated for months by exploiting a Previously compromised PEC mailbox belonging to the Ministry of the Interior. Initially the criminal group, known by the name IamNotTheVillain, he had asked Revolut a ransom of $3 million in cryptocurrenciesthreatening to put the data obtained for sale on the Dark Web as loot. The ultimatum, set 24 hours after the incident was claimed, expired several days ago and would not have produced the requested payment.
Now, according to what was reported to the Corriere della Sera by one of the hackers involved in the attack, the strategy would have changed: the data would already be available for sale and the individual users affected by the thing, including 15 Italiansthey could be contacted directly by cybercriminals. In fact, the hacker claims to have started selling the stolen information and states that it would be possible to request the deletion of one’s data from the database by paying a sum of money. However, this is a promise made by the attacker and, as happens in similar cases, there is no guarantee that the information will actually be eliminated.
The hacker’s revelations about data: transactions, faces and documents
According to the cyber criminal, they would be over 680 high net worth individuals potentially exposed to consequences such as attempts to steal money, phishing and cyber attacks of various kinds. Some images relating to the owners of the accounts used to open Revolut accounts were also published on a site that can be visited on the Dark Web, as proof of possession of the data. Not surprisingly, the attacker declared to Corriere della Sera:
From now on, more than 680 high-net-worth individuals are at risk of experiencing money theft, phishing attacks, cyber breaches and every other type of crime imaginable.
The documentation published online would be quite heterogeneous: many files would be empty, while others would contain particularly sensitive information. In one they would appear well 719 pages with the history of transactions carried out on the Revolut account, from its opening until the time of the attack, while another would show the face and identity document of a customer. It is no coincidence that the hacker, in listing the documents stolen in the attack, explained:
We have everything, including KYC (Know Your Customer) documents, addresses, phone numbers, emails, bank accounts, and fiat currency and cryptocurrency transactions.
One of the most interesting revelations made by the protagonist of the attack concerns the number of Italians involved. According to this source they would be at least 15which we should however add other residents abroad in possession of Italian documents. However, the statement does not constitute an independent verification of the actual number of people involved and should be taken with a grain of salt.
Negotiations with a fake Revolut intermediary
According to the hacker, following the attack, there would then have been attempts to negotiate with an alleged Revolut spokesperson who would have tried to negotiate with the criminal group. However, the attackers would have branded the alleged Revolut spokesperson as a «impostor».
The hacker also claims that the story would not stop exclusively at Revolut. Other companies were also reportedly affected and further information may be released soon. However, the Italian Postal Police and the British Information Commissioner’s Office, the British authority responsible for data protection, are continuing to work on the case.
