Revolut faces a public $3 million ransom demand in Monero from the group iamnotavillain after a breach exposed identity documents and other personal information linked to about 680 European customers. The group claims to hold 147 gigabytes of passports, driving licences, identity documents and photographs, and threatened to sell the data within 24 hours. Italian prosecutors said attackers used a compromised institutional email account belonging to the Reggio Calabria prefecture to submit requests that appeared to come from a government body. Revolut said customer funds, accounts and core systems were not compromised, although identity documents, birth dates, contact details and other verification material were exposed. An earlier claimant calling itself Revolut Smilik reportedly demanded 10,000 Bitcoin. Italy's National Anti-Mafia and Counter-Terrorism Directorate, prosecutors in Reggio Calabria and data-protection authorities in Italy and Lithuania are investigating whether the government email account was infiltrated or cloned. The incident has renewed concerns about social engineering, government data-request controls and the security risks created by mandatory KYC data retention, as well as similar attacks targeting private customer records.