Hackers claiming to have breached the major digital bank Revolut have threatened to sell confidential information belonging to hundreds of its customers to other criminal organizations, demanding a ransom payment of $3 million within 24 hours in exchange.

According to the Financial Times, the group, which calls itself iamnotavillain, published the ultimatum on its website on Wednesday afternoon, accompanied by a digital countdown timer.

The public ransom demand is unusual, as hackers typically prefer to make such demands privately and only publicize the case if their target refuses to pay or negotiate. In such cases, they usually post details of the cyberattack on leak websites on the dark web.

In its online message, the group called on Revolut to pay “6,000 XMR / $3,000,000… otherwise all the data will be sold and the blood will be on your hands.” XMR is the cryptocurrency Monero, which is frequently used by hackers because its transactions are difficult to trace.

The group told the Financial Times, via Telegram, that it was using the particular website for the first time to publicize its demands and that no negotiations with Revolut had taken place so far. At the same time, they presented screenshots with some information redacted from data they allegedly obtained from the bank.

Shortly after publishing the ransom demand, the hackers sent the FT a 60-second screen recording video, in which an unidentified user appeared to be browsing files supposedly originating from Revolut.

The documents shown in the video appeared to include customers’ driving licenses, passports and identity photographs, which had been used as part of the “Know Your Customer” (KYC) identity verification process, as well as transaction histories. The data breach is estimated to have affected at least 680 customer accounts.

According to the Financial Times, the hackers obtained the records after breaching an Italian government email system. Through it, they allegedly posed as law enforcement officials and, for several months, requested information about specific Revolut customer accounts.

The group claimed that it selected its targets using blockchain analysis in order to identify Revolut accounts with significant cryptocurrency holdings.

Revolut said on Wednesday evening that it “has not received any direct communication or demand from the individuals or group making these claims.”

Several Revolut customers who are reportedly affected have expressed concern over the possibility that their personal data may have been compromised.

Revolut had earlier stated that it was providing affected customers with “immediate support” and that it was “working closely with the relevant law enforcement and regulatory authorities.”

Since its founding in 2015, Revolut has grown into Europe’s largest financial technology company, operating as a bank in more than 30 countries and serving 80 million customers. Its valuation recently reached $115 billion as part of a secondary share sale.