A group claiming to have accessed Revolut customer information is demanding $3 million in Monero (XMR), giving the financial services company 24 hours to make the payment. The group has also threatened to sell the allegedly stolen data to other criminal organizations if the ransom is not paid.

The attackers, operating under the name “iamnotavillain,” posted a demand for 6,000 XMR on Wednesday and included a countdown clock, the Financial Times reported.

Revolut said it has not been approached directly by the individuals or group behind the claims. A company spokesperson told CoinDesk, “Revolut has not received any direct contact or demand from the individuals or group making these claims.”

At least 680 customer accounts were reportedly involved in the incident. The attackers claimed they identified their targets through blockchain analysis, focusing on Revolut customers with sizeable cryptocurrency holdings.

As evidence, the group provided the FT with a 60-second video recording that appeared to show data allegedly taken from affected accounts. The material reportedly included passports, driver’s licenses, images used during know-your-customer procedures and transaction histories.

The incident allegedly stemmed from attackers posing as government officials and submitting fraudulent information requests that passed Revolut’s verification controls. The company supplied customer records before later discovering that the requests were not legitimate, according to notices previously sent to customers affected by the incident.

Revolut previously said it had blocked the address involved in the fraudulent requests and notified the appropriate government agency, law enforcement and regulators. The company also said there was no impact on its systems or customer funds.

The group told the FT that it had not held any negotiations with Revolut as of the newspaper’s publication.