{ "version": 1, "event_id": "evt_55d03d5566d723d1", "url": "https://xiyu.news/events/evt_55d03d5566d723d1/", "json": "https://xiyu.news/api/events/evt_55d03d5566d723d1.json", "type": "security_incident", "status": "developing", "category": "crypto", "title": { "zh": "Revolut 黑客索要 300 万美元门罗币，威胁出售客户数据", "en": "Revolut hackers demand $3 million in Monero, threaten to sell customer data" }, "current_state": { "zh": "名为“iamnotavillain”的团体要求 Revolut 在24小时内支付 6,000 XMR（约300万美元），否则将出售至少680个账户的客户身份文件和交易记录；Revolut 回应称未收到直接联系或勒索要求，受影响客户数量有限，资金和系统未受影响，报道称数据源自被入侵的意大利政府邮件系统且攻击者事前通过链上分析筛选了高净值客户。", "en": "A group calling itself 'iamnotavillain' has given Revolut 24 hours to pay 6,000 XMR (~$3 million) or it will sell customer identity documents and transaction records from at least 680 accounts; Revolut responded that it has received no direct contact or demand, called the number of affected customers 'limited,' said funds and systems were untouched, and the report says the data came via a compromised Italian government email system after attackers used blockchain analysis to target high-net-worth users." }, "first_seen_at": "2026-09-16T23:08:37.396594+00:00", "last_updated_at": "2026-09-17T17:11:56.649444+00:00", "last_material_change_at": "2026-09-17T17:11:56.649444+00:00", "confidence": 0.75, "updates_count": 2, "sources_count": 2, "entities": [ "customer", "data", "demand", "hackers", "monero", "ransom", "report", "revolut", "sell", "threaten" ], "identifiers": [], "topics": [ "data-breach", "data-privacy", "extortion", "monero", "revolut", "security-breach" ], "updates": [ { "update_id": "upd_c9a45c20c3d1911b", "event_id": "evt_55d03d5566d723d1", "occurred_at": "2026-09-16T19:07:34Z", "published_at": "2026-09-16T19:07:34Z", "first_seen_at": "2026-09-16T23:08:37.396594Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Revolut 黑客索要 300 万美元门罗币，威胁出售客户数据", "title_en": "Revolut hackers demand $3 million in Monero, threaten to sell customer data", "what_changed_zh": "据《金融时报》报道，一个自称 \"iamnotavillain\" 的黑客组织要求 Revolut 在 24 小时内支付 6000 枚门罗币（XMR，约合 300 万美元），否则将把窃取的客户数据出售给其他犯罪团伙。此次泄露至少影响 680 个 Revolut 客户账户，该组织还向《金融时报》提供了一段 60 秒的屏幕录像，内容似乎包含护照、驾照、KYC 验证照片和交易记录。\n\n这是一起在拥有超过 8000 万客户的头部数字银行得到确认的数据泄露事件，被泄露的是攻击者专门挑选出来的、持仓规模较大的加密用户的身份文件和交易记录。它凸显了受监管金融科技公司所持有的 KYC 与身份数据可能成为被定向攻击的资产，也再次印证了门罗币作为勒索付款首选结算通道的角色。\n\n攻击者向《金融时报》表示，他们通过链上分析来锁定持有大量加密资产的 Revolut 账户，并称截至报道发布时双方尚未进行任何谈判。据报道，此次泄露源于攻击者冒充政府官员发送信息调取请求并绕过了 Revolut 的核查流程；Revolut 表示已封堵相关请求所使用的地址，并通知了相关政府机构、执法部门和监管机构，其系统与客户资金未受影响。", "what_changed_en": "Hackers calling themselves 'iamnotavillain' are demanding $3 million in Monero within 24 hours from Revolut, threatening to sell stolen customer data from at least 680 accounts that reportedly includes identity documents and transaction histories.", "current_state_zh": "据《金融时报》报道，一个自称 \"iamnotavillain\" 的黑客组织要求 Revolut 在 24 小时内支付 6000 枚门罗币（XMR，约合 300 万美元），否则将把窃取的客户数据出售给其他犯罪团伙。此次泄露至少影响 680 个 Revolut 客户账户，该组织还向《金融时报》提供了一段 60 秒的屏幕录像，内容似乎包含护照、驾照、KYC 验证照片和交易记录。\n\n这是一起在拥有超过 8000 万客户的头部数字银行得到确认的数据泄露事件，被泄露的是攻击者专门挑选出来的、持仓规模较大的加密用户的身份文件和交易记录。它凸显了受监管金融科技公司所持有的 KYC 与身份数据可能成为被定向攻击的资产，也再次印证了门罗币作为勒索付款首选结算通道的角色。\n\n攻击者向《金融时报》表示，他们通过链上分析来锁定持有大量加密资产的 Revolut 账户，并称截至报道发布时双方尚未进行任何谈判。据报道，此次泄露源于攻击者冒充政府官员发送信息调取请求并绕过了 Revolut 的核查流程；Revolut 表示已封堵相关请求所使用的地址，并通知了相关政府机构、执法部门和监管机构，其系统与客户资金未受影响。", "current_state_en": "Hackers calling themselves 'iamnotavillain' are demanding $3 million in Monero within 24 hours from Revolut, threatening to sell stolen customer data from at least 680 accounts that reportedly includes identity documents and transaction histories.", "detailed_summary_zh": "Hackers calling themselves 'iamnotavillain' are demanding $3 million in Monero within 24 hours from Revolut, threatening to sell stolen customer data from at least 680 accounts that reportedly includes identity documents and transaction histories.", "detailed_summary_en": "Hackers calling themselves 'iamnotavillain' are demanding $3 million in Monero within 24 hours from Revolut, threatening to sell stolen customer data from at least 680 accounts that reportedly includes identity documents and transaction histories.", "background_zh": "门罗币是 2014 年推出的隐私型加密货币，其设计目标是隐藏交易细节、使资金流向难以追踪，这一特性使其成为勒索软件与敲诈勒索中常见的付款方式。Revolut 是一家总部位于英国的数字银行应用，全球超过 8000 万客户使用其多币种账户、跨境汇款和加密交易服务。根据 KYC（了解你的客户）规则，受监管金融机构必须收集身份文件和验证照片，这意味着一次成功的社工请求就可能泄露高度敏感的个人记录。", "background_en": "Monero is a privacy-focused cryptocurrency launched in 2014 that is designed to obscure transaction details, making it difficult to trace payments — a property that has made it a common choice in ransomware and extortion demands. Revolut is a UK-headquartered digital banking app used by more than 80 million customers globally for multi-currency accounts, remittances and crypto trading. Under know-your-customer (KYC) rules, regulated financial firms must collect identity documents and verification photos, which means a single successful social-engineering request can expose highly sensitive personal records.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件让 XMR 作为被索要的付款资产受到关注，把隐私币叙事与一宗正在进行的敲诈案件联系在一起；而攻击者按加密持仓筛选账户的做法，也让保管用户 KYC 记录的交易所和金融科技平台面临数据安全层面的担忧。任何市场反应更可能通过隐私币情绪以及市场对加密相关金融科技公司保管个人数据的信任度传导，而非通过直接的供给或流动性变化。", "market_impact_en": "The incident puts XMR in the spotlight as the demanded payment asset, tying a privacy-coin narrative to an active extortion case, while the targeting of accounts by crypto holdings raises data-security concerns for exchanges and fintech platforms that custody user KYC records. Any market reaction would likely flow through sentiment around privacy coins and trust in crypto-adjacent fintech custody of personal data rather than through direct supply or liquidity changes.", "importance_score": 7.5, "references": [ { "url": "https://markets.bitcoin.com/crypto/monero", "title": "Monero (XMR) Price, Charts, and Info | Bitcoin.com Markets" }, { "url": "https://www.revolut.com/", "title": "Banking & Beyond | Revolut United Kingdom" }, { "url": "https://www.breadcrumbs.app/", "title": "Blockchain Analytics: Crypto Tracker | Breadcrumbs Crypto" } ], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:70bbb860d2a47298" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/16/revolut-hackers-demand-usd3-million-in-monero-threaten-to-sell-customer-data", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_35e54fac08e4b910", "event_id": "evt_55d03d5566d723d1", "occurred_at": "2026-09-17T12:53:01Z", "published_at": "2026-09-17T12:53:01Z", "first_seen_at": "2026-09-17T17:11:56.649444Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "报道称Revolut黑客索要300万美元门罗币赎金，威胁出售客户数据", "title_en": "Revolut Hackers Demand $3M Monero Ransom, Threaten to Sell Customer Data: Report", "what_changed_zh": "Revolut 表示未收到该团体任何直接联系或勒索要求，并称受影响客户数量“有限”、资金和系统未受影响；报道补充称数据通过入侵意大利政府邮件系统、以真实域名和有效认证伪装的信息请求在数月内获取，攻击者先用链上分析筛选高净值用户，并已向 FT 展示文件录屏。", "what_changed_en": "Revolut said it has not received any direct contact or demand from the group, called the number of affected customers 'limited,' and said funds and systems were untouched; the report adds that data was obtained via a compromised Italian government email system using genuine domains and valid authentication over months, with attackers using blockchain analysis to target high-net-worth users and showing the FT a screen recording of files.", "current_state_zh": "名为“iamnotavillain”的团体要求 Revolut 在24小时内支付 6,000 XMR（约300万美元），否则将出售至少680个账户的客户身份文件和交易记录；Revolut 回应称未收到直接联系或勒索要求，受影响客户数量有限，资金和系统未受影响，报道称数据源自被入侵的意大利政府邮件系统且攻击者事前通过链上分析筛选了高净值客户。", "current_state_en": "A group calling itself 'iamnotavillain' has given Revolut 24 hours to pay 6,000 XMR (~$3 million) or it will sell customer identity documents and transaction records from at least 680 accounts; Revolut responded that it has received no direct contact or demand, called the number of affected customers 'limited,' said funds and systems were untouched, and the report says the data came via a compromised Italian government email system after attackers used blockchain analysis to target high-net-worth users.", "detailed_summary_zh": "A group calling itself iamnotavillain has given Revolut 24 hours to pay 6,000 XMR (~$3M) or it will sell hundreds of customers' identity documents and transaction records, while Revolut says it has received no direct contact or demand.", "detailed_summary_en": "A group calling itself iamnotavillain has given Revolut 24 hours to pay 6,000 XMR (~$3M) or it will sell hundreds of customers' identity documents and transaction records, while Revolut says it has received no direct contact or demand.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.95, "story_ids": [ "rss:decrypt.co_feed:e3971044961c50ee" ], "sources": [ { "url": "https://decrypt.co/378472/revolut-hackers-demand-3m-monero-ransom-threaten-to-sell-customer-data-report", "label": "Decrypt", "source_type": "rss", "official": false } ] } ] }