Threat Intelligence · Privacy
Revolut Data Breach Exposes Sensitive Customer Information After Fake Government Requests
Revolut has confirmed a data breach where attackers, posing as a government agency, accessed personal and financial details of hundreds of high-profile customers. The breach lasted months before discovery.
Ross GrantUpdated 3 min read
The short version
Attackers tricked Revolut into handing over sensitive customer data by pretending to be a government agency. They used a real government email account to make their requests look official. Revolut says only a small number of high-profile customers were affected, and customer funds were not touched. The attackers are now demanding a ransom and threatening to sell the stolen data.
By the numbers
- 680high-profile Revolut customers reportedly affectedSecurityWeek
- 5 monthsduration attackers accessed dataSecurityWeek
- $3 millionpublic ransom demand by attackersSecurityWeek
- 147GBdata allegedly stolen from Italian law enforcementSecurityWeek
What happened?
Revolut confirmed that attackers posing as a government agency accessed personal and financial data of some customers over a five-month period. The attackers used a compromised government email account to submit fake requests. About 680 high-profile accounts were reportedly affected. A $3 million ransom demand has been made publicly, but Revolut says it has not been contacted directly.
What information was exposed?
According to SecurityWeek (opens in a new tab), Revolut notified a subset of users that their personal and financial information was accessed by an unauthorised third party. The exposed data included names, addresses, phone numbers, email addresses, dates of birth, occupation, copies of driver's licences and passports, and verification selfies. Financial details such as IBANs, account statements, withdrawal records, and full transaction histories (including Bitcoin transactions) were also compromised.
How did the breach happen?
Attackers reportedly compromised an employee account at the Italian Ministry of the Interior and used it to send fraudulent data requests to Revolut, posing as a legitimate government agency. Because financial institutions are required to respond to official requests, Revolut treated these as genuine and handed over customer data. The attackers used valid technical credentials, making the requests appear authentic. The campaign is believed to have lasted about five months before Revolut discovered the deception and blocked the attacker’s email address (SecurityWeek (opens in a new tab)).
Who was affected?
Revolut has not publicly stated the exact number of affected customers. However, SecurityWeek reports that about 680 high-profile customers, described as cryptocurrency "whales", had their information compromised. The company says it has contacted all impacted individuals directly and provided support. Revolut also stated that customer funds and its core systems were not affected by the breach.
What have the attackers done?
A threat actor using the name ‘IAmNotAVillain’ has publicly demanded a $3 million ransom from Revolut, threatening to sell the stolen customer information. Revolut says it has not received any direct contact or ransom demand from the attackers. The hackers also claim to have stolen 147GB of data from an Italian law enforcement agency, and Italian police have launched an investigation.
What has Revolut done in response?
After discovering the breach, Revolut blocked the compromised email address and notified the relevant government agency, law enforcement, data protection, and financial regulators. The company says it has contacted affected customers and is providing support. Revolut has not disclosed the full scale of the breach or the specific government agency involved.
What should customers do?
If you are a Revolut customer and have not been contacted by the company, your data is likely not affected. However, it is wise to be alert for phishing attempts or unusual account activity. Customers should monitor their accounts, consider changing passwords, and be cautious about sharing personal information online. If you receive any suspicious communication claiming to be from Revolut or a government agency, verify its authenticity before responding.
What happens next?
The Italian police are investigating the compromise of their employee’s email account. Revolut and regulators may continue to assess the impact and could face regulatory scrutiny. Under UK and EU law, companies can face significant fines for failing to protect personal data, up to £17.5 million or 4% of global turnover under UK GDPR, and €20 million or 4% under EU GDPR, whichever is higher.
Claimed vs confirmed
- Confirmed
Attackers accessed Revolut customer data by impersonating a government agency.
Revolut confirmed to SecurityWeek that attackers used a legitimate government domain to submit fraudulent requests.
- Unconfirmed
680 high-profile Revolut customers were affected.
SecurityWeek reports this figure, but Revolut has not confirmed it.
- Unconfirmed
Attackers are demanding a $3 million ransom from Revolut.
A threat actor made the demand publicly, but Revolut says it has not received direct contact.
- Unconfirmed
147GB of police data was stolen from an Italian law enforcement agency.
Reported by SecurityWeek based on hacker claims; not confirmed by authorities.
The impact
- Money
- Revolut could face regulatory fines under UK or EU GDPR, which can reach up to £17.5 million or 4% of global turnover. The attackers are demanding a $3 million ransom, but Revolut has not paid or been contacted directly.
- Reputation
- Revolut's reputation may be affected, especially among high-profile customers and those concerned about privacy. The breach highlights risks in handling official data requests.
- Customers
- Impacted customers face risks of identity theft and targeted scams. Revolut says it has contacted those affected and is providing support. Customers should watch for phishing and monitor their accounts.
Why it matters
The breach shows how attackers can exploit trust in official processes to access sensitive data. Customers whose information was exposed face risks of identity theft and targeted scams. The incident raises questions about how companies verify legal requests and protect customer privacy.
How does it work?
Attackers compromised a government employee's email account and used it to send fraudulent data requests to Revolut. Because the requests appeared to come from a legitimate government domain, Revolut complied, believing them to be official legal requests. This allowed the attackers to access sensitive customer data over several months.
Key points
- Attackers used a compromised government email to trick Revolut into sharing customer data.
- Personal and financial details of about 680 high-profile customers were exposed.
- The breach lasted about five months before discovery.
- Attackers are demanding a $3 million ransom but have not contacted Revolut directly.
- Revolut says customer funds were not affected and has contacted those impacted.
Sources
SecurityWeek
Reference
