A data-extortion crew claims to have stolen sensitive records belonging to customers of the fintech Revolut and has begun leaking them online, vowing to publish more every day until the company pays.
According to Cointelegraph, the attackers started posting stolen material on Sept. 14 alongside a threat: “We’re going to start releasing more and more data everyday until revolut pays for leaking their customers.” No ransom figure was disclosed.
The exposed information is unusually sensitive. Reporting indicates it includes customers’ full names, dates of birth, occupations and contact details, along with account statements and complete transaction histories — including records of Bitcoin activity — plus copies of identity documents such as passports and the selfies customers submit for identity verification. Revolut has said only a “limited number” of individuals were affected, and the crypto investigator known as ZachXBT indicated the incident appeared to target high-net-worth users. Red Robot is not republishing the identities of those named in the leak.
Revolut has framed the episode not as a hack of its systems but as a con. The company described “a sophisticated external impersonation scam” in which an unauthorized third party used a legitimate government agency’s email domain to submit fraudulent requests for customer information. Those requests initially cleared Revolut’s authentication checks; the company said it later determined they were not genuine, blocked the fraudulent address, and notified the relevant government agency, law enforcement and financial regulators. Impacted customers were contacted directly and offered support.
Crucially, Revolut said the incident did not compromise its core infrastructure or customer money: “Revolut systems and customer funds are unaffected,” the company stated. The exposure, in other words, came through social engineering aimed at Revolut’s information-request process rather than a breach of its transaction rails.
That detail offers cold comfort to those whose passports and verification selfies are now circulating. Identity documents and biometric-style images are precisely the material used to open fraudulent accounts and defeat know-your-customer checks elsewhere, which is why extortionists treat them as leverage. The daily-leak threat is designed to escalate pressure on the company over time rather than all at once.
The case is a reminder that strong technical defenses can be bypassed when attackers target the people and processes around them. Impersonation scams that abuse trusted institutional email domains have become a recurring theme in financial-sector breaches, and they are hard to stamp out because they exploit legitimate channels. For affected Revolut customers, the immediate risk is not lost funds but identity fraud — and the prospect that, if the attackers are to be believed, more of their data could surface each day.
Written for Red Robot with AI assistance and human editing. Based on reporting by Cointelegraph.
