Hackers linked to the September customer-data disclosure at British fintech Revolut have demanded about $3 million, reported as 6,000 XMR, in Monero (privacy-focused cryptocurrency) within 24 hours or threatened to sell records from hundreds of customers to criminal groups. The demand, attributed to the threat actor IAmNotAVillain, is a sharp reduction from the 10,000 Bitcoin figure circulated on Telegram over the weekend. Researchers say the payment vehicle shifted to Monero because its design obscures transaction participants and amounts, complicating on-chain tracking. The Financial Times reported that Revolut had not been contacted by the perpetrators through a negotiated channel and had not yet received a ransom demand directly, despite the public countdown on the actor’s leak site. Revolut first notified affected customers on 12 September 2026 after a fraudulent information request from an authenticated government mailbox was accepted by its compliance team. The disclosure exposed identity documents, passport and driving-licence copies, verification selfies, contact details, IBANs, account statements, withdrawal records and full transaction histories, including Bitcoin activity. The actor claims 680 customers were targeted, mostly in Switzerland and France, with others in 31 mainly European countries, but those country shares have not been independently confirmed by Revolut. Italian reports also attribute an unverified claim of 147 GB of law-enforcement files to the actor. The United Kingdom’s ICO (data-protection regulator) is assessing a report, while the FCA (financial-services regulator) is engaging with Revolut. The company says its systems and customer funds were unaffected, with the main remaining risks being targeted extortion and account-recovery social engineering. Key developments would include a public Revolut response to the new demand, identification of the impersonated agency, or a regulator filing addressing the legal-request process.