Revolut—Revolut exposed customers' KYC data after attackers used a fraudulent government email to pass its verification checks
Revolut confirmed a data breach in which attackers impersonating a government agency via a spoofed official email address obtained sensitive KYC data on an undisclosed number of customers, described by a crypto security researcher as appearing targeted at high-net-worth users. Exposed data included full names, dates of birth, occupations, postal and email addresses, phone numbers, passport and driver's license images, facial verification selfies, IBANs, and full transaction histories including Bitcoin transactions. Revolut declined to name the government agency involved or specify affected markets, and did not explain why email domain authentication alone was sufficient to release such sensitive data. On September 14, 2026, the attackers began publicly leaking customer data and threatened to release more daily until paid, escalating from theft to extortion.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| User Privacy | -against | secondary | -0.50 |
| Overall incident score = | -0.347 | ||
Score = avg(topic contributions) × significance (high ×1.5) × confidence (0.62)× agency (negligent ×0.5)
Evidence (2 signals)
Cointelegraph: Revolut breach attackers begin leaking customer data and threaten daily releases
On September 14, 2026, the attackers behind the Revolut breach began publicly posting leaked customer data and threatened to release additional data daily until Revolut pays, escalating the incident from data theft to active extortion. Affected individuals identified publicly included tennis player Alexander Shevchenko and Gamdom CEO Felix Roemer.
TechCrunch: Revolut confirms customer data breach through fake government requests
Revolut confirmed to TechCrunch that attackers used a fraudulent government email address to obtain sensitive KYC data, including IDs, selfies, addresses, and transaction histories, for a limited but undisclosed number of customers.