Revolut Data Breach: How Fake Government Requests Exposed Customer Records

Revolut says an unauthorised party obtained sensitive customer information after the company responded to fraudulent requests sent from a legitimate government-agency email domain. The September 12 disclosure is significant because the attackers apparently did not need to break into Revolut’s core systems: they exploited trust in an official-looking communication channel. Revolut says affected customers were contacted and that customer funds and its systems were unaffected. 134

What Revolut confirmed

Revolut confirmed that fraudulent information requests came from an email address on a legitimate government-agency domain and resulted in customer information being disclosed to an unauthorised third party. The company described the incident as a “sophisticated external impersonation scam,” said it blocked the address after detection, and said it alerted relevant authorities. 13448

This distinction matters. The available reporting does not establish that attackers breached Revolut’s core banking infrastructure or accessed customer funds. It does establish that a process for handling sensitive external requests was deceived. 134

How the impersonation reportedly worked

The confirmed element is narrow but consequential: the requests used a real government-domain email address. A technically authentic-looking sender domain can make a fraudulent request appear routine, particularly where teams handle legal or law-enforcement requests at speed. 135

Some subsequent reporting linked the sender to Italy’s PEC certified-email infrastructure and to the Interior Ministry’s pec.interno.it domain. That attribution has not been independently confirmed by Revolut or Italian authorities in the material available here, so it should be treated as a reported lead—not an established account of the attack. 37

The broader lesson is that email-domain authenticity alone is not adequate proof that a demand for highly sensitive data is legitimate. A request should be verified independently through a known agency contact route and subjected to escalation controls before records are released.

How many people were affected?

Revolut initially said the breach affected a “very limited” number of customers and did not publish a figure. 1

Later reporting put the total at roughly 680 customers worldwide, with 12 Irish customers reported among them. Revolut had not publicly confirmed that count in its initial statement, so the figure should be understood as reported rather than as a number directly announced by the company. 33

Reports also relayed an attacker claim that the operation involved access to Italian law-enforcement systems over approximately six months. That is an unverified claim by the alleged threat actor, not a confirmed finding by Revolut or authorities. 3637

What data may have been exposed

Customer notifications reviewed by TechCrunch said the disclosed material included identity and contact information such as dates of birth, postal and email addresses, phone numbers, and copies of passports or driving licences. The notification said the information may also have included verification selfies, account statements and transaction histories. 35

Other reporting described IBANs, withdrawal records and Bitcoin transaction activity among the material allegedly obtained. 510

Taken together, this is a particularly sensitive combination: identity documents can support impersonation and account-recovery fraud, while contact and financial information can make phishing attempts appear unusually credible.

Why Bitcoin transaction information changes the risk

A name, address, identity document and verification selfie can link a real person to financial activity. Where Bitcoin transaction history is included, the exposure may make it easier to connect verified offline identity data with activity that is visible on a public blockchain. 1035

That does not mean every wallet or future transaction is automatically attributable. But the combination can increase the likelihood of tailored phishing, identity fraud, coercion attempts and scams aimed at people perceived to hold crypto assets. Unlike a password, identity documents and past blockchain records cannot simply be changed after a leak.

Leaks, named individuals and the claimed ransom

Attackers were reported to have begun publishing customer material and threatening further releases. Reporting identified files said to belong to tennis player Alexander Shevchenko and Gamdom chief executive Felix Römer; Cointelegraph reported that Römer commented after his details appeared in the leak. 2

A purported demand for 10,000 BTC—reported as roughly $780 million at the time—circulated in posts and secondary reporting. Revolut did not confirm the demand, and neither did law enforcement in the cited material. It should therefore be treated as an unverified extortion claim, rather than a confirmed ransom negotiation. 1213

What affected customers should do

Customers who received a notification should preserve it and follow Revolut’s official guidance. They should also be especially cautious about messages that cite personal details, claim to be from Revolut or a regulator, or create urgency around account security.

Useful defensive steps include:

• Change Revolut and email passwords if they are reused anywhere else, and enable the strongest available multi-factor authentication.
• Treat unsolicited calls, texts and emails as suspicious—even when they include accurate personal information.
• Never share one-time passcodes, recovery codes or seed phrases with a caller or sender.
• Monitor bank, card and crypto-exchange accounts for unexpected activity, and document suspicious contacts.
• For people whose identity documents were disclosed, consider the risk of future identity fraud rather than assuming the danger ends when a card is replaced.

In the UK, the Information Commissioner’s Office advises people concerned that an organisation has not kept their data safe to contact the organisation first and provides public support channels for data-protection concerns. 23

The operational lesson for financial firms

This incident shows why sensitive government or law-enforcement requests need controls beyond sender-domain checks. Effective safeguards can include independent callback verification using trusted directory details, dual approval for unusually sensitive disclosures, strict data minimisation, auditable request records and clear procedures for spotting authority-based social engineering.

For customers, the key takeaway is equally direct: an official-looking email address is evidence to investigate, not proof to trust. In a breach involving identity records and financial history, follow-on fraud can be more damaging than the initial disclosure itself.

What remains unknown

The evidence supports that Revolut disclosed customer data after fraudulent requests from a legitimate government domain and that its core systems and customer funds were not affected, according to the company. 1

Important details remain unresolved in the supplied reporting: the precise role of PEC infrastructure, the alleged six-month timeline, the full number of customers affected, the attackers’ claimed access to Italian systems, and the status of any enforcement action by UK regulators. Those claims should not be presented as settled facts without official confirmation. 133637