What we know about the Revolut customer data leak

Attackers who tricked UK-based online bank Revolut into handing over sensitive customer information are currently releasing stolen details while allegedly threatening to keep leaking until the fintech coughs up over 10,000 BTC.

At current prices, that would put the ransom at roughly $780 million.

Revolut hasn’t confirmed the demand or authenticated any of the material currently circulating online. Many on social media have also expressed doubt that this ransom demand is real, with Revolut investor and crypto analyst Max Karpis pointing out that such a payment would be easily traced, making it extremely difficult to cash out.

Read more: Trezor’s summer of hacks continues with Brevo email breach

Attacker posed as government agency

An unidentified third party targeted Revolut over the weekend, using a legitimate government agency domain to pass the bank’s security checks and request customer information.

Information potentially disclosed included names, dates of birth, addresses, email addresses and phone numbers, alongside copies of passports and driving licences.

According to Revolut, the number of affected customers was “very limited,” but it stopped short of giving a precise figure.

Customer notifications also reportedly referenced account statements, IBANs, withdrawal records and transaction histories, including BTC activity.

According to posts on X, the attackers are seeking 10,000 BTC in exchange for not releasing additional customer data.

The figure hasn’t been confirmed by Revolut and the bank has so far limited its public comments to confirming that customer data was disclosed.

Nor has the bank indicated whether it intends to negotiate with the attackers or if the alleged material circulating online is genuine or represents the full dataset stolen.

Read more: OneKey ‘hacked’ already-patched Ledger app

Former Mt. Gox CEO among victims

It’s been reported that at least some affected customers may be high-profile or high-net-worth individuals.

Indeed, former Mt. Gox CEO Mark Karpelès has revealed that he was among those affected by the breach.

The Block reported that Karpelès shared a copy of the notification he received from Revolut, which said account statements, IBANs, withdrawal records and full transaction histories – including BTC transactions – may have been exposed.

On-chain investigator ZachXBT has also suggested that the attackers may have specifically targeted wealthy Revolut customers and that the attack appeared to involve a relatively small number of high-net-worth users.

Revolut says customer funds are safe

In a statement, Revolut told Protos, “Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.

“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators.

“Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support.”

This would suggest that the incident was primarily a data-disclosure event rather than an attack in which customers’ accounts or crypto were directly targeted.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.