Revolut handed customer identity and financial records to government impersonators
Revolut disclosed customer records after fraudulent requests from a genuine government email domain. About 680 people were reportedly affected; Revolut has not confirmed that count. Check with in-app support and beware of personalised scams.
Open Revolut directly and use in-app support to confirm whether you were affected and which records were disclosed. Be cautious of unexpected calls or messages quoting your personal details or transactions; never share login codes or move money at a caller’s request.
What’s happening
Revolut handed sensitive customer information to an unauthorised party using an email address on a legitimate government agency domain. Its customer notification said information potentially disclosed included contact details, passports or driving licences, verification selfies, account statements, IBANs and transaction histories, including Bitcoin transactions. Revolut confirmed a limited number of affected customers but did not confirm SecurityWeek’s estimate of approximately 680, reportedly large cryptocurrency holders. The company said it blocked the address, contacted affected people and notified authorities and regulators; its systems and customer funds were unaffected. On 16 September, someone claiming responsibility publicly demanded US$3 million, while Revolut said it had received no direct demand. A 30 September government update reported no confirmed conclusion to the case. As at 3 November, the reviewed sources do not establish whether a ransom was paid, exposed records were recovered or deleted, or anyone was arrested. There is no customer software patch for this disclosure.
- What
- Breach
- Affects
- Revolut banking and cryptocurrency services
- Fixed in
- Nothing to patch
- Since
- 12 Sept 2026
- Closed
- 30 Sept 2026
Timeline
- Update
A Basque Government update said the perpetrators’ identities, final number of affected customers and conclusion of the proceedings had not been publicly confirmed. Revolut had not specified when the requests began or how long they continued.
- Update
SecurityWeek reported approximately 680 affected customers, reportedly large cryptocurrency holders, without confirmation of that count from Revolut. It cited investigators describing roughly five months of fraudulent requests, while attackers separately claimed six months.
- Update
Someone claiming responsibility publicly demanded US$3 million and threatened to sell customer records. Revolut said it had received no direct contact or demand from those making the claims.
- Update
Revolut said it had blocked the email address, contacted affected customers and alerted authorities and regulators. Its customer notice listed identity documents, verification selfies and financial records among the information potentially disclosed; the company said systems and customer funds were unaffected.
- Made publicNothing to patch
Revolut confirmed that fraudulent government requests had exposed customer information.
Sources
- Revolut says customer KYC, Bitcoin transaction data exposed after fake request from gov't domainThe Block · 12 Sept 2026
- Revolut confirms customer data breach through fake government requestsTechCrunch · 12 Sept 2026
- Personal, Financial Info Exposed in Revolut Data BreachSecurityWeek · 14 Sept 2026
- Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M RansomSecurityWeek · 17 Sept 2026
- Brecha de datos en Revolut tras solicitudes gubernamentales fraudulentasBasque Government · 30 Sept 2026