A hacker tricked Revolut into handing over passport copies and sensitive data belonging to 680 customers — then demanded 10,000