Update, Sept. 26, 2026: The attackers claiming responsibility for the Revolut data breach have reportedly opened a dedicated leak site and begun attempting to extort affected customers directly, marking an escalation from the earlier $3 million demand aimed at Revolut. The attackers are threatening further exposure of customer information while offering victims the purported removal of their data in exchange for payment. Italy’s data protection authority has also opened an investigation into the incident and is coordinating with Lithuania’s privacy regulator, where Revolut’s principal European establishment is located. The Italian regulator said the case highlighted weaknesses in the country’s certified PEC email system and is investigating whether other financial institutions may have been targeted through similar fraudulent government requests.
Revolut has confirmed a data breach involving highly sensitive customer information after an unauthorized third party used a legitimate government agency email domain to submit fraudulent requests for customer records.
The British fintech company described the incident as a sophisticated external impersonation scam. Unlike a conventional intrusion, Revolut said its own systems were not compromised. Instead, the company disclosed information after receiving requests that appeared to originate from a legitimate government authority.
The information potentially handed over includes identity documents, verification selfies, contact information, bank account details, account statements and transaction histories. For some affected customers, the disclosed records also included Bitcoin transaction information.
Initial disclosures described the number of affected customers only as limited. Subsequent reporting indicates approximately 680 customer accounts were affected, with customers across multiple European countries involved.
Attackers allegedly abused Italian government email system
Additional reporting since the breach was first disclosed has provided significantly more detail about how the fraudulent requests were delivered.
The attackers claim they compromised access to Italy’s certified email system, known as Posta Elettronica Certificata, or PEC, and used it to impersonate Italian law enforcement while requesting information from Revolut.
PEC is used in Italy for authenticated official and legal communications. Messages sent through the system can carry legal significance similar to registered mail, making access to a legitimate government account particularly useful for an attacker attempting to impersonate an authority.
A person familiar with the incident confirmed to the Financial Times that the requests received by Revolut came through Italy’s PEC system and that communications continued for several months.
The attackers claim they repeatedly requested confidential information on specific Revolut customers while posing as law enforcement. Those requests allegedly sought information including customer addresses, phone numbers and transaction histories.
Revolut fulfilled requests under the belief that they were authentic. The company later identified the activity as fraudulent, blocked the address and alerted the relevant government agency.
Italian authorities are investigating the incident. It remains unclear exactly how the attackers obtained control of the government account or whether the compromise affected additional organizations.
Around 680 Revolut accounts reportedly affected
The breach appears significantly more targeted than a conventional bulk data theft operation.
Approximately 680 Revolut customer accounts were reportedly affected, with the attackers claiming they specifically selected customers holding significant cryptocurrency assets.
The attackers allegedly used blockchain analysis to identify potential targets before requesting their information from Revolut. The claim has not been independently established for every affected account, but it could help explain why the attackers sought records on a relatively small number of customers rather than attempting to obtain Revolut’s broader customer database.
Reporting indicates affected customers were located across dozens of European countries, with significant numbers in Switzerland and France.
Revolut has not publicly released its own exact victim count or provided a country-by-country breakdown.
Passports, selfies and transaction records exposed
The information disclosed varied between affected customers but could contain a significant collection of identity and financial information.
Potentially compromised information includes names, dates of birth, postal addresses, email addresses and telephone numbers, along with copies of government-issued identification such as passports and driver’s licenses.
Verification selfies used during identity checks were also potentially disclosed.
Financial information may include IBANs, account statements, withdrawal records and transaction histories. Some customers were informed that their complete Bitcoin transaction histories were among the records provided to the unauthorized requester.
The combination creates a particularly sensitive exposure. Identity documents and verification photographs could support impersonation and identity fraud, while transaction records and account information could provide attackers with detailed knowledge of a victim’s financial activity.
The reported targeting of customers with substantial cryptocurrency holdings adds another potential risk. Information linking an individual’s identity and home address with significant cryptocurrency holdings could potentially expose victims to highly targeted phishing, extortion or other forms of criminal activity.
Attackers issue $3 million extortion demand
The incident entered a new phase on Sept. 16 when the attackers claiming responsibility issued a public extortion demand against Revolut.
The attackers reportedly demanded $3 million in Monero and threatened to sell confidential customer records to other criminals if the company did not pay within 24 hours.
The group has displayed samples of allegedly stolen information and provided additional material to journalists in an attempt to substantiate its claims.
Revolut said it has not received any direct communication or ransom demand from the individuals claiming responsibility for the breach.
That distinction means the public extortion attempt should not be interpreted as evidence that Revolut has entered negotiations with the attackers.
Revolut says accounts and customer funds remain secure
Revolut said the incident did not involve unauthorized access to its systems and that customer funds were not affected.
The disclosure therefore differs from an intrusion in which attackers penetrate a financial institution’s infrastructure and extract records directly. In this case, the attackers allegedly exploited trust in an authenticated government communications channel to persuade Revolut to provide information.
Revolut said it implemented precautionary protection measures for affected customers and contacted those whose information was involved.
The company has also notified law enforcement, relevant data protection authorities and financial regulators.
Revolut has not publicly disclosed evidence that the exposed information was used to directly access customer accounts or steal funds.
Incident highlights risks around government data requests
The breach demonstrates a path to sensitive financial information that does not require compromising the financial institution holding the data.
Financial institutions routinely receive legitimate requests for customer records from law enforcement agencies, regulators and other government authorities. An attacker capable of controlling an authenticated government communications account can potentially exploit that trust to obtain information without penetrating the financial institution’s network.
The reported use of Italy’s PEC system makes the incident particularly notable because the attackers allegedly exploited an established channel for trusted legal and government communications rather than simply spoofing the visible sender address of an ordinary email.
The months-long exchange also raises questions about how requests for sensitive financial information are independently verified when they arrive through otherwise trusted government infrastructure.
Revolut says its internal systems and customer funds remain unaffected. The incident is now under investigation by law enforcement and data protection authorities, while regulators are examining whether similar abuse of trusted government communications may have affected other financial institutions.
