Revolut Data Breach: What We Know a Month On
In September 2026 Revolut handed customer data to criminals who posed as a government agency. A month later the company has confirmed how many people were affected and promised to pay for their new identity documents. Here is the full timeline, what was exposed, what is confirmed and what is only claimed, and what crypto users should do now.
What Happened
Revolut received what looked like formal information requests from a legitimate government agency email domain. The requests passed technical domain authentication, and staff answered them as routine legal compliance work. They were fraudulent. Revolut calls it “a sophisticated external impersonation scam” and says it blocked the address once the activity was detected.
Italian Interior Minister Matteo Piantedosi later said the request came from a police email network in Reggio Calabria, through an account that had never been used before, and that Revolut had not verified it sufficiently. Revolut’s Western Europe CEO, Béatrice Cossa-Dumurgier, said the bank’s own security stayed intact and described government agencies as “the most vulnerable link in the security chain”.
Timeline
| Date | Event |
|---|---|
| 11 Sep 2026 | Revolut notifies affected customers. |
| 12 Sep 2026 | Blockchain investigator ZachXBT shares the notification publicly. |
| 14 Sep 2026 | Revolut confirms the incident to the press. |
| 14–15 Sep 2026 | People claiming responsibility post data samples on Telegram and demand 10,000 BTC. |
| 16 Sep 2026 | The Financial Times reports a separate demand of about $2.9m in Monero. |
| 7–9 Oct 2026 | Revolut confirms 680 affected clients and pledges to cover ID replacement costs. |
What Was Exposed
According to customer notifications shared by ZachXBT and reported by The Register and Infosecurity Magazine, the data handed over could include full names, dates of birth, home and email addresses, phone numbers and occupations; copies of passports or driving licences and verification selfies; and IBANs, account statements, withdrawal records and full transaction histories, including Bitcoin transactions. Revolut says its systems and customer funds were not affected.
Revolut serves more than 80 million personal customers worldwide, so 680 is a small share. For each of those people, though, the leak is close to what Muhammad Yahya Patel of security firm Huntress called “a complete identity theft kit”.
Ransom Claims — Confirmed vs Claimed
Two very different figures have circulated. Telegram posters claiming responsibility demanded 10,000 BTC, worth more than $782 million at the time, and threatened to publish more data every day. The Financial Times separately reported a demand of about 6,000 Monero, roughly $2.9 million, from a group calling itself “iamnotavillain”. Both are claims by the attackers. Revolut says it has received no direct demand, and Cossa-Dumurgier told BFM TV that no ransom has been paid.
📌 Confirmed by Revolut: 680 clients assisted, systems and funds unaffected, regulators and law enforcement notified, ID replacement costs covered. Claimed by attackers only: the ransom amounts and the scale of any further leaks.
Why It Matters for Crypto Users
Many crypto users buy coins through fintech apps rather than traditional banks, and our Ireland and Portugal guides cover Revolut as an on-ramp. A leak that combines ID documents, selfies and transaction histories is exactly what fraudsters need for convincing phishing, account-takeover attempts and fake “support” calls. In our view, exposed Bitcoin transaction records could also make it easier to link people to their wallets.
How to Protect Yourself
- Treat unexpected calls, emails or messages claiming to be Revolut, a bank or a government body as suspicious.
- Never share passwords, passcodes or one-time codes — no genuine provider asks for them.
- Contact Revolut only through the official app or website.
- Turn on multi-factor authentication and use a unique password for every financial and crypto account.
- Watch your accounts and credit reports, and report suspected identity misuse quickly.
Our USDT TRC20 explainer covers wallet basics, including why you should always verify an address before sending funds.
FAQ
How did the Revolut data breach happen?
Criminals sent fraudulent information requests from a legitimate government agency email domain. The requests passed domain authentication and staff answered them as routine legal compliance. Revolut calls it a sophisticated external impersonation scam.
How many Revolut customers were affected?
Revolut's Western Europe CEO said the company has assisted 680 affected clients. Revolut has more than 80 million personal customers worldwide.
Did Revolut pay a ransom?
No. Revolut's Western Europe CEO told BFM TV that no ransom has been paid, and Revolut says it received no direct demand. The 10,000 BTC and roughly $2.9 million figures are claims made by attackers.
Will Revolut pay for new ID documents?
Yes. In October 2026 Revolut said it will cover the costs for affected customers who need to replace their identity documents.
Sources
↗ The Register — Revolut falls for fake government requests, hands over customer data (14 Sep 2026) ↗ Infosecurity Magazine — Revolut confirms data breach through fake government requests ↗ Computing — Hackers demand 10,000 Bitcoin from Revolut ↗ PYMNTS — Revolut hackers issue $3 million ransom for customer data ↗ PYMNTS — Revolut pays for new customer IDs after September data breach ↗ TechCentral.ie — Revolut compensates customers who have to apply for new identity documents18+ only. Gambling laws differ by country and change quickly — check the rules where you live. If gambling stops being fun, BeGambleAware and GamCare offer free, confidential support.