Eight Italians, 25 Spaniards, 27 Romanians — and no sign that Revolut paid the ransom Local counts so far: 12 in Ireland, 27 in Romania, 25 in Spain, 8 in Italy, according to the media. Revolut has not published its own country list. It still says only a “limited” number. No evidence it paid a ransom. IAmNotAVillain posted a demand for 6,000 XMR, about $3m, with a 24-hour clock. Revolut told Reuters it had had no direct contact and no demand. The deadline passed. Nothing public followed. Italy is investigating two separate claims. One is settled enough: Revolut did hand over customer files. The other is not: the group’s story that it stole 147 GB from the Interior Ministry. Sole 24 Ore reports that the Postal Police have found no confirmed breach of ministry systems so far. Investigators still do not know whether a real PEC account was taken over or only copied. Giulia Pastorella (Azione) says Undersecretary Ferro used the figure of eight Italian customers to avoid the real question — how a government mailbox was used. She adds that attacks over certified email almost doubled in 2025 (CERT-AgID) and that a black market exists for institutional PEC accounts. How it started. For months, mail arrived from a real Italian government domain. Revolut sent identity documents, selfies, statements and Bitcoin histories. Later, it checked with the agency, blocked the address and told those customers. The app was not broken into. The money did not move. The files did. Three warnings were in that correspondence. The sender was a local-authorities PEC at the Reggio Calabria prefecture. The letter inside was framed as a European Investigation Order, which in Italy only a prosecutor or a judge can issue. Staff then told the sender to put the Cyprus crypto company on the letterhead instead of the Italian branch, and still sent the files. The 680 people on the list are waiting to see whether their documents are offered for sale. The Italian government has not yet said how that official mailbox was used.