Revolut Data Disclosure: What’s Confirmed, What’s Claimed, and What Remains Unverified

Revolut has confirmed that sensitive customer information was disclosed to an unauthorized third party after the company received fraudulent requests sent from a legitimate government-agency email domain. The company characterizes the event as an external impersonation or social-engineering scam—not a confirmed compromise of its core systems. 12

The incident has also prompted a public ransom claim by a group using the name “iamnotavillain.” But a central caveat matters: Revolut told Reuters that it had received no direct contact or ransom demand from the people claiming responsibility. 2

What Revolut has confirmed

According to Revolut’s statement reported by Reuters, fraudsters used a legitimate government-agency email domain to submit deceptive requests for customer information. Revolut then disclosed sensitive information to an unauthorized third party before detecting the fraud. 1

Revolut said affected customers had been notified and initially described the number as “very limited.” Reuters later reported that the incident was understood to involve about 680 customers, though that figure was not disclosed by Revolut in its initial public statement. 12

Reporting based on notifications to affected customers indicates that exposed information could include identity and contact data, such as dates of birth, addresses, phone numbers, and copies of identity documents. TechCrunch reported that the information may also have included verification selfies, account statements, and other account-related material. 5

Was Revolut’s infrastructure hacked?

Based on Revolut’s account and reporting from a source familiar with the matter, Revolut’s core infrastructure, databases, and customer accounts were not hacked. Revolut also said its systems and customer funds were unaffected. 12

That distinction is important. The confirmed event was a data disclosure induced by fraudulent requests, rather than a confirmed technical intrusion into Revolut’s account systems or databases. Public reporting does not independently establish every technical detail of the incident, so the full scope should not be overstated. 12

The reported $3 million demand

The Financial Times reported that the actors claiming responsibility threatened to sell confidential records of hundreds of Revolut customers to criminal groups unless the company paid $3 million within 24 hours, according to Reuters. 2

Other reports identify the requested payment as 6,000 Monero (XMR), valued at roughly $3 million at the time, and name the purported actor as “iamnotavillain.” The group reportedly posted its ultimatum online alongside a countdown clock and said negotiations had not occurred. 46

These details are claims made by, or attributed to, the alleged attackers. They do not establish that the group’s identity is genuine, that it possesses all the records it claims to have, or that it could carry out the threatened sale. Revolut’s statement that it received no direct demand adds further uncertainty about the status of the public ultimatum. 26

What is known—and what is not

Supported by Revolut’s statement and major reporting

• Fraudulent requests sent from a legitimate government-agency email domain led to an unauthorized disclosure of sensitive customer information. 1
• Revolut says its systems and customer funds were unaffected. 1
• Reuters reported that Revolut had no direct contact or ransom demand from the alleged perpetrators. 2
• Reporting places the affected customer count at approximately 680. 24

Still unverified or dependent on attacker claims

• Whether “iamnotavillain” is the person or group behind the disclosure. 26
• Whether the group holds the full set of records it claims to possess. 26
• Whether any data has been sold, shared, or otherwise used by additional criminal groups. 2
• The full technical and operational chain that allowed the fraudulent requests to appear credible. 12

Bottom line

The available evidence supports a narrower but serious conclusion: Revolut disclosed sensitive customer data after being deceived by fraudulent requests that appeared to originate from a legitimate government email domain. Revolut disputes that its core infrastructure or customer accounts were breached. 12

The $3 million Monero demand, 24-hour deadline, countdown clock, and “iamnotavillain” attribution are publicly reported but remain allegations tied to the purported attackers. Until those claims are independently corroborated, they should be treated separately from the disclosure Revolut has confirmed. 26