Revolut confirmed it released customer records to a scammer using a genuine government email domain, exposing about 680 accounts and triggering a 10,000 Bitcoin ($780 million) extortion demand. The UK Information Commissioner's Office has opened a formal investigation, putting the incident inside the UK GDPR penalty framework as Revolut prepares a listing valued near $200 billion.
Revolut handed customer records to a scammer operating from a genuine government email domain, exposing roughly 680 accounts and drawing a 10,000 Bitcoin extortion demand worth about $780 million, the London-based digital bank confirmed.
The attackers did not breach Revolut's app or core banking systems. They sent a fraudulent data request from an email address hosted on an official government domain, complete with valid domain-authentication credentials, and Revolut released the records through its standard disclosure process. The company called the incident a "sophisticated external impersonation scam" and said it blocked the address once detected.
The disclosed material spans nearly every category of Know Your Customer data: full names, dates of birth, occupations, postal and email addresses, phone numbers, passport or driving-licence copies, and the facial image submitted during onboarding. Financial records may include account statements with IBANs, account status, opening dates, wallet reference numbers, withdrawal records and complete transaction histories, including Bitcoin activity. Revolut said biometric facial telemetry was not compromised and that customer funds were unaffected.
The ransom demand of 10,000 Bitcoin was priced at roughly $780 million based on a Bitcoin price near $77,974 at the time of reporting. The attackers have said they will publish customer data daily until payment is made. No payment has been confirmed.
Revolut self-reported to the UK's Information Commissioner's Office, which confirmed it opened a formal investigation. That filing puts the incident inside the UK GDPR penalty framework, where the ICO can levy fines of up to £17.5 million or 4 percent of global annual turnover, whichever is higher. For a company that has been preparing an initial public offering at a valuation near $200 billion, the percentage limb is the one that carries weight.
The ICO has not published a timeline or indicated whether it considers the breach a systems failure or a process failure. That distinction drives the outcome. Under UK GDPR, controllers are assessed on whether they implemented appropriate technical and organisational measures — and a disclosure workflow that treats an authenticated email as sufficient authorisation is exactly the kind of control gap regulators examine. The Financial Conduct Authority, which supervises Revolut's UK banking licence, has not commented publicly on the matter.
The breach also raises a question the ICO has not addressed: whether the data left the UK. The attackers have accused Revolut of sharing customer information with countries outside its jurisdiction, an allegation the company has not detailed publicly.
Blockchain investigator ZachXBT said on Telegram that the operation appeared to target high-net-worth individuals. Screenshots circulating online showed the attackers had already published data belonging to Felix Römer, chief executive of online crypto casino Gamdom. Mark Karpelès, former chief executive of the collapsed Mt Gox exchange, said he received a Revolut alert at 5:25 a.m. on September 12 warning that his data may be at risk. Karpelès said Revolut should not have shared the information regardless of whether the email appeared legitimate.
A threat actor using the name "IAmNotAVillain" claimed the operation ran for six months and involved compromised Italian law-enforcement channels, and claimed possession of 147 gigabytes of Italian-side material. Those claims have not been independently verified. A screenshot bearing the actor's watermark appears to show archives labelled "Document Revolut" and one extracted folder containing 688 files across 204 folders. Screenshots alone cannot establish authenticity or completeness.
The combination of data types is what makes the exposure durable. A verified identity, a home address, an IBAN and a Bitcoin transaction history in one file gives an attacker everything needed for convincing bank impersonation, SIM-swapping attempts and crypto-targeted extortion. Unlike a password, a passport scan cannot be rotated.
Revolut has been working toward a public listing valued at around $200 billion, well above its most recent private valuation of $75 billion. A live regulatory investigation, an active extortion campaign and a daily data-release threat all land in the disclosure documents a listing would require.
The direct financial exposure is bounded. UK GDPR fines at the upper end would be material but not existential against a $200 billion target. The larger cost sits in the multiple. Neobanks are valued on user growth and cross-sell economics, and Revolut's crypto trading and wealth features are central to that story — the same high-value segments the attackers targeted. If affected customers close accounts, the churn shows up in the metrics underwriters price.
The structural lesson extends past Revolut. Authenticated email proves a message passed through infrastructure authorised by a domain; it does not prove the sender is legitimate or the request lawful. For the fintech sector, the incident argues for independent verification through a previously registered agency contact, case-number validation, dual approval on high-risk disclosures and tamper-evident audit logs. Revolut has not said how many fraudulent requests succeeded, which agency's domain was abused, or whether the activity was confined to one country.
This article is for informational purposes only and does not constitute investment advice.
