Revolut hacked? Data breach: passports, IBANs, and Bitcoin

Revolut data breach after false government request: Passports and Bitcoin histories exposed #

On September 12, 2026, Revolut confirmed a data breach involving a "very limited" number of customers. This wasn't a direct attack on the company's systems: the attackers exploited a fake government request , using a legitimate email address from a public agency to convince Revolut to hand over sensitive data.

The information obtained through the fraud includes copies of passports and driver's licenses, selfies used for identity verification, bank statements, IBANs, and transaction histories, including those involving Bitcoin . Since September 13, some of the material has been published online by the attackers themselves, who have threatened to publish new material daily.

The attackers also reportedly demanded a ransom of 10.000 bitcoins , equivalent to approximately $780 million at the time of initial reports, but the amount has not been confirmed by Revolut or any independent sources. No ransomware or APT group has yet been identified as responsible for the attack.

Incident in brief #

Countryside	Detail
Organization hit	Revolut
Platform/process involved	Internal process for responding to data requests from government authorities (“Emergency Data Request”)
Unauthorized access data	Not applicable in the traditional sense: no intrusion into Revolut's systems. The exact date the fraudulent request was sent/fulfilled is unknown (prior to September 11, 2026).
Date discovered	September 11, 2026 (Revolut blocks fraudulent email address)
Public disclosure date	Customer notifications on September 11, 2026 (21:59 UTC); made public on September 12 by Mark Karpelès and ZachXBT, confirmed by Revolut to TechCrunch on the same day
Organizations/people involved	The number is undisclosed, described by Revolut as "very limited"; according to investigator ZachXBT, it is mostly high-net-worth users with ties to the crypto world.
Type of data involved	Name, date of birth, occupation, address, email, phone number, copies of ID documents, verification selfies, bank statements, IBAN, withdrawal and transaction history (including Bitcoin)
Data actually published online	Only a portion of the material obtained: identity documents and selfies attributed to some publicly identified people, starting from September 13, 2026
Responsible group	Claimed by an individual calling themselves “IAmNotAVillain” (claim dated September 14, 2026, not independently confirmed by Revolut)
Claim	Yes — partial data release and ransom demand (10.000 BTC), not officially confirmed by Revolut
Public IOCs	No

Strict use of terms: three different things, not synonyms #

It is worth immediately clarifying three distinctions that are often blurred in the telling of the story.

The first concerns how the data leaked : there was no unauthorized access to Revolut's systems. The company stated that "Revolut systems and customer funds were not compromised." The data was not stolen through a cyberattack on its servers: it was handed over by Revolut staff to a party posing as a legitimate authority, in (apparently) compliance with standard procedure. This is an important technical distinction, but—as a journalist following the story noted—"it does not eliminate the liability issue of those holding that data." For the customers involved, the practical result—that is, the exposure of identity documents and financial data to an unauthorized party—is the same as a traditional data breach.

The second distinction is between exposed and published data . “Exposed” refers to the data that Revolut provided in response to the fraudulent request—the entire package described above. “Published” refers only to the portion of that data that the attackers actually released online, on X and Telegram, starting on September 13. Available sources do not state that the entire data package provided has been made public: at the moment, only IDs and selfies relating to some identifiable individuals have been published, not necessarily the entire data set of all affected customers.

The third distinction, less immediate but crucial to understanding the incident, is between authentication and authorization . The email address used for the request was authentic: it truly belonged to a government agency, so it passed any "authority" check. But the fact that the sender was authentic doesn't mean that the specific request was authorized by the appropriate person within the agency: it could have been a compromised account used without the agency's knowledge. Authentication (the address is real) and authorization (whoever controls it at the time actually has the right to make this request) are two different things, and it's precisely the second check that, according to available sources, appears to have been missing.

What happened, simply explained #

Revolut, one of the world's most popular fintechs with over 80 million users (it's also among the most popular banking and payment apps in Italy), regularly receives data requests from government authorities and law enforcement—a standard practice for any bank or financial institution, often related to investigations or emergencies that require rapid responses.

The problem is that someone gained access to a real email address from a government agency (Revolut didn't specify which one, nor the country it came from) and used it to send a request for data that appeared completely legitimate, coming from a genuine domain. Revolut responded by providing the requested information, "with the reasonable belief that it was a genuine government request." Only later did the company identify the anomaly, block the address, and notify the agency involved, law enforcement, data protection authorities, and financial regulators.

According to The Record, the compromised email domain appears to belong to an Italian government agency. This detail has not been publicly confirmed by Revolut and has not been confirmed by other verified sources, so it should be treated with caution.

According to publicly disclosed data, the affected clients include former Mt. Gox CEO Mark Karpelès, crypto entrepreneur Marc Zeller, tennis player Alexander Shevchenko, and Felix Römer, CEO of the online cryptocurrency casino Gamdom—a factor that reinforces the hypothesis of a selective targeting of high-net-worth users, particularly in the crypto sector.

How to check if you are involved #

No official or verifiable list of those involved has been published at this time: the only known identities have emerged because some of the individuals involved (like Karpelès) voluntarily disclosed the notification they received, or because their documents appeared among the material released by the attackers. Those who were actually involved should have received (or should receive) a direct email from Revolut, detailing the specific data exposed in their case.

For this reason, any message related to this matter—even one that appears to cite real account information—must be verified exclusively through official Revolut channels (the app or website, without using links or numbers provided in the message itself). There's no way to independently verify whether you're among those involved outside of direct communication from the company.

Why this data combination is dangerous #

Taken individually, many of the data involved (an address, a phone number) have limited value. The problem is the combination: ID, verification selfie, personal details, IBAN, financial transactions, cryptocurrency transactions, and contact information, all together and referring to the same person, constitute what one security expert has called "a complete identity theft kit." With this set of information, an attacker has, in one fell swoop, both the means to falsely prove themselves to third parties that they "are" the victim, and the detailed knowledge of their real financial situation to lend credibility to any subsequent approach.

Specifically, this combination of data lends itself to: impersonating the victim on other financial services or at Revolut itself; personalized phishing , with messages that accurately state the victim's balance, transactions, or actual beneficiaries to appear legitimate; vishing (telephone scams) in which the caller demonstrates prior "knowledge" of the victim's account; account recovery attempts based on stolen identity documents; financial fraud, such as credit requests or account openings in the victim's name; and, for cryptocurrency-related customers, specific targeting of those with visible Bitcoin transaction histories, a particularly attractive profile for those seeking cryptocurrency assets to target with targeted scams.

What to do if you fear you may be involved #

Anyone who has received (or fears they may receive) a notification from Revolut should: check account activity, active cards, saved beneficiaries, and linked devices directly from the app or official website, without using links or phone numbers received via email/SMS/WhatsApp claiming to be "Revolut security assistance"; be wary of anyone who contacts you by phone using the information provided in the scam, even if they appear to know your real account details; monitor any unsolicited credit or account opening requests, for example, by checking your credit report.

Editorial review: What Revolut has done, what remains unclear #

In terms of immediate response, sources describe behavior consistent with best practices: Revolut detected the anomaly, blocked the fraudulent email address, promptly notified the relevant authorities (the agency involved, law enforcement, data protection authorities, and financial regulators), and contacted the affected customers individually, specifying which data concerned them—a level of transparency toward the affected users that goes beyond simple generic communication.

However, at least two points remain unclear in the company's public communication. The first is the decision not to disclose which government agency (or which country) was impersonated: an understandable reticence given the ongoing investigation, but one that leaves customers without a complete picture of what actually happened. The second is the number of people involved, described only as "very limited" without a figure: a definition that, given the amount of data per individual user (documents, selfies, financial and transaction data), leaves considerable room for interpretation.

A journalist who followed the story nailed the underlying problem: financial institutions are trained to trust requests coming from authentic government email addresses, and this trust—not a technical flaw in Revolut's systems—is what was exploited. This is a valid observation, but it doesn't eliminate one point: as clarified above, a genuine address is not equivalent to an authorized request. The sources do not report whether Revolut had additional controls in place for "urgent" government requests before the incident, nor whether any were introduced afterward. Some measures that generally reduce the risk of this type of fraud, and which the sources do not confirm are already in place by Revolut, include: verifying the request through a second, independent channel (for example, contacting the agency at its published official contact information, not the one cited in the request itself); more rigorous validation of the request's identity and authority; mandatory internal escalation for requests involving particularly sensitive data or a large number of individuals; Systematic logging and auditing of received and processed EDR requests; and limiting the data returned to the bare minimum necessary to fulfill the request, rather than a comprehensive package for each individual involved.

Technical analysis #

Attack vector #

The source confirmed the attack is a fraud known as an "Emergency Data Request" (EDR) scam . The chain, as reconstructed from available sources, is as follows: an account or email address belonging to a government agency ends up in the hands of an unauthorized individual (the sources do not specify whether this was due to direct account compromise, credential theft, or other unauthorized domain access). From that authentic address, a request for data, labeled as urgent, is sent to Revolut. Revolut evaluates it and, lacking (or not applying) independent verification of the request's authorization, grants it. Only later is the anomaly identified and the address blocked. The weakness is not strictly technical—there are no exploits, malware, or software vulnerabilities involved—but rather a process: there is no second check to distinguish a genuine sender from an actually authorized request.

This technique isn't new: in 2021-2022, the LAPSUS$ group obtained sensitive data from Apple, Meta, and Discord using the same scheme, exploiting compromised law enforcement accounts to send emergency requests that the companies fulfilled without independent verification. In November 2024, the FBI published a specific public warning about the growing criminal market for accessing compromised government email accounts specifically for the purpose of fraudulent EDR requests—a context that makes the Revolut incident far from isolated in the known threat landscape. We've already discussed this in general terms in our in-depth analysis of phishing and social engineering vectors used in red teaming , a technique conceptually similar to this type of impersonation, although here the target isn't an employee targeted with a phishing email, but rather the company's own process for deciding to whom sensitive data should be disclosed.

The reason this vector is particularly effective against companies like Revolut is structural: a fintech with tens of millions of users manages, for each customer, precisely the type of data (identity, documents, financial history) that authorities legitimately request as part of investigations—and is therefore organized to respond to these requests quickly, often precisely because "emergency" implies urgency. The same characteristic that makes the process useful to legitimate law enforcement agencies (speed of response, trust in the institutional sender) is the same one an attacker exploits: the more the company manages sensitive data on a large scale and the more pressure it is to respond quickly, the more profitable the vector becomes for anyone who manages to impersonate an authority.

Initial cause and disclosure phase: two distinct moments #

As in the cyber kill chain , it's useful to separate two events that tend to overlap in the narrative. The initial cause of the incident was the fraudulent request and its acceptance by Revolut: this is when the data left the company's perimeter, at an unspecified time before September 11, 2026. The disclosure phase , which began on September 13, is a subsequent and distinct phase: the attackers, already in possession of the data, chose to publish part of it online as a lever for extortion. These two phases have different dynamics—the first is a problem with verifying company processes, the second is a post-incident pressure tactic—and it is the latter, not the former, that determines which specific data actually becomes publicly visible.

Timeline #

Before September 11, 2026The fraudulent request is sent and fulfilled by Revolut. The exact date is unknown—the "dwell time" (time between data delivery and its discovery) cannot be calculated using publicly available information.
11 September 2026Revolut detects the anomaly, blocks the fraudulent email address, and begins notifying affected customers individually at 21:59 PM UTC.
12 September 2026Mark Karpelès and investigator ZachXBT have released the notification they received; Revolut confirms the incident to TechCrunch, describing it as an impersonation scam and specifying that systems and funds were not compromised. At this stage, the attackers have not yet released any material: these are notifications from the company, not a claim of responsibility from the data collector.
13 September 2026The attackers began publishing some of the obtained material online on X and Telegram—specifically, documents and selfies attributed to tennis player Alexander Shevchenko and Felix Römer (CEO of Gamdom). Available sources do not specify whether a third party independently verified the authenticity of these documents beyond their provenance, stated by the attackers themselves, and the public acknowledgement by some of the individuals involved.
14 September 2026Reports emerge of a ransom demand of 10.000 BTC (about $780 million) to stop further publications; attackers threaten new daily data releases. Neither the amount nor the authenticity of the ransom demand have been confirmed by Revolut or any independent sources.
14 September 2026, 22:23 a.m.An individual calling himself "IAmNotAVillain" claims, via an account X specializing in cybersecurity, to have compromised the systems of multiple Italian law enforcement departments over the past six months and used them to construct the fraudulent request to Revolut, also stealing 147 GB of internal documents, calendars, and communications. This claim is unconfirmed: no independent source or Italian authority (State Police, Carabinieri, Guardia di Finanza) has so far verified it.

Responsible group #

As of September 14, no reliable source had attributed the attack to a known APT or ransomware group. That evening, a claim of responsibility emerged from an individual calling himself "IAmNotAVillain," who claims to have had six-month access to the systems of multiple Italian law enforcement departments—from which the fraudulent request sent to Revolut was allegedly constructed—and to have separately stolen 147 GB of internal documents, calendars, and communications from those same agencies. The claim was circulated via an industry-specific account X and has not been confirmed by either Revolut or Italian authorities: it should be treated as unverified, not as established fact.

IOC / TTP #

The sources consulted did not publish verifiable technical indicators of compromise (IOCs) (specific email addresses, domains, hashes). In terms of technical observables (TTPs), the incident can be broken down as follows: compromise or unauthorized abuse of a government email account/domain to obtain a legitimate sender; impersonation of a legitimate authority over Revolut staff assigned to handle requests; abuse of a trusted communication channel, without any technical exploit against Revolut; social engineering targeting a business process rather than an individual employee via phishing emails; data disclosure by the victim themselves, not active exfiltration from a compromised system; and, in the next phase, extortion through progressive data publication, an "extortion-only" scheme without system encryption, increasingly common in data-targeted campaigns rather than traditional ransomware.

Technical impact #

Since there was no intrusion into the systems, the impact is measured by the sensitivity and breadth of the data involved for each affected customer: ID, verification selfie, contact details, and financial information (account statements, IBAN, withdrawal and transaction history, including Bitcoin). The sources do not specify whether the entire data set listed was provided for each affected customer or a subset that differed on a case-by-case basis. Revolut has not provided a figure for the number of people involved; public information indicates a small but high-net-worth group. Available sources do not indicate any lateral movements, escalation of privileges, or access to internal Revolut systems: the incident, as far as we know, originated from an exchange of a request and a response via email, without ruling out intermediate steps not documented by the sources consulted.

Response from the organization #

Revolut said it immediately blocked the fraudulent email address, notified the government agency involved, law enforcement, data protection authorities, and financial regulators, and contacted the affected customers directly via email, specifying which categories of data had been exposed in their specific cases. The sources did not report whether specific services, such as credit or identity monitoring, were offered to the affected customers, nor did they provide details on any changes to the internal process for verifying government requests introduced after the incident.

What we know and what we don't know #

Confirmed:

Revolut was subjected to a government impersonation scam that resulted in the disclosure of data on a limited number of customers.
Revolut systems and customer funds were not compromised, according to the company.
The data released as a result of the fraud included identity documents, selfies, financial data, and transaction histories, including Bitcoin.
The attackers began publishing some of that data online, on X and Telegram, starting on September 13, 2026.
This isn't Revolut's first breach: in 2022, an attack affected the data of 50.150 customers.

Unconfirmed:

Which government agency and which country were impersonated (the hypothesis of an Italian domain reported by a single source is not confirmed by Revolut or any other sources).
The exact number of customers involved and whether they all received the same set of exposed data.
Whether the material published online so far represents the entire data package delivered or just a portion selected by the attackers for demonstration purposes.
The authenticity and exact amount of the ransom demand (10.000 BTC).
The identity or affiliation of the attackers, the “IAmNotAVillain” claim, and the alleged six-month compromise of Italian law enforcement systems have not been independently confirmed.
Whether the fraudulent request was sent from a compromised government account or through other means of accessing the domain.

FAQ #

Were Revolut's systems hacked? No. Revolut has stated that its systems and customer funds were not compromised. The data was handed over by Revolut staff to a party posing as a legitimate government authority, not stolen through a cyberattack.

What's the difference between "exposed" data and "published" data? "Exposed" is the entire data that Revolut provided in response to the fraudulent request. "Published" is only the portion of that data that the attackers have actually released online so far. Sources have not confirmed that all of the exposed data has been published.

What data exactly was exposed? Name, date of birth, occupation, address, email, phone number, copies of identity documents (passport or driver's license), verification selfies, bank statements, IBAN, and withdrawal and transaction history, including Bitcoin.

How many customers are affected? Revolut didn't provide a figure, saying only a "very limited" number. Some researchers suggest the primary target was high-net-worth users with ties to the crypto world, but this hasn't been officially confirmed.

Is there a public list of those involved, or can I check if I'm on it? No, there is no verifiable public list. Known identities have emerged only because some of the individuals involved have made the notification they received public, or because their information has appeared in material circulated online. The only way to know if you're involved is for Revolut to notify you directly through its official channels.

How did the attackers obtain the data without breaching the systems? They used an email address belonging to a legitimate government agency to send an "urgent" data request, which Revolut deemed authentic and responded to. This technique, known as "emergency data request" (EDR) fraud, has been used in the past by other actors against Apple, Meta, and Discord.

Was a ransom paid? It hasn't been confirmed. There are reports of a demand for 10.000 BTC (about $780 million) to stop further data releases, but neither Revolut nor independent sources have confirmed the amount or any payment.

Who carried out the attack? On September 14, a person calling themselves "IAmNotAVillain" claimed responsibility for the attack, claiming that they had used access to Italian law enforcement systems for six months to construct the fraudulent request. This is a claim, not a confirmation: no independent source or Italian authority has verified it.

What should I do if I've received a notification from Revolut, or if someone contacts me mentioning this incident? Verify transactions, cards, beneficiaries, and connected devices only through the official Revolut app or website. Ignore links or numbers received via email, SMS, or WhatsApp related to this incident. Be wary of calls mentioning your exposed information to appear more credible. Any official communication regarding the incident should be verified only through Revolut channels, and never respond to the person who first contacted you.

Conclusion #

The most significant aspect of this incident isn't technical: no servers were hacked, no exploits were used, no software vulnerabilities were exploited. Obtaining the IDs, selfies, and financial histories of customers of a fintech with over 80 million users didn't require compromising Revolut's infrastructure—it was enough to compromise the mechanism by which the company decides who to hand over that data to when someone, apparently legitimately, requests it. It's the same pattern seen against Apple, Meta, and Discord years ago, and it's further proof that, in many organizations handling sensitive data on a large scale, the weakest link isn't always the firewall or the code: it's often the human process that decides, under pressure from an "emergency," who to open the door to.