Revolut has confirmed that it disclosed sensitive customer data to an unauthorised third party after receiving fraudulent information requests sent from an email account operating inside a real government agency's domain, in a customer notification that began circulating on 11 September 2026 and was reviewed by TechCrunch. The company's notification states that the communication carried valid domain authentication credentials and was therefore "fulfilled under the reasonable belief that it was an authentic government agency request" — the impersonation defeated the sender-authentication checks that are supposed to establish that a message genuinely originates from an authority.

The disclosed material covers full name, date of birth and occupation; postal address, email address and telephone number; a copy of the customer's identity document, either passport or driver's licence; and the facial verification image supplied at onboarding. Revolut says the data may also have included account statements and transaction histories, with multiple outlets reporting the transaction data covered Bitcoin, and it has stated specifically that no biometric facial telemetry was involved. The company blocked the email address after discovering the scam, alerted the relevant government agency, law enforcement and financial regulators, and says its systems and customer funds are unaffected.

The significance is structural rather than volumetric: what left the building is the complete identity-verification package a regulated fintech is obliged to collect, assembled and delivered in a single response to an authority-looking request. The control that failed is one of the few integrity checks an organisation typically applies to inbound government correspondence, and it is a control that a spoofed message which passes domain authentication cannot defeat on its own. Crypto researcher ZachXBT surfaced the notification publicly on 11 September.

Escalation — 18 September 2026

The extortion front around the incident sharpened on 17 September, when a group calling itself IAmNotAVillain published a countdown demanding 6,000 Monero (about US$3 million) and threatening to sell the customer records. Revolut says it has received no direct contact or demand, the competing claimants publicly dispute which of them actually holds the data, and at least one has accused a former associate of taking credit for material it never had — so the volume claim is a negotiating position rather than a measured figure. Press reporting puts the affected population at roughly 680 of Revolut's 80 million customers, selected for suspected cryptocurrency holdings. The regulatory footprint widened with it: the UK Information Commissioner's Office has an open investigation, and because the fraudulent requests were sent from inside a government email domain, Italy's National Anti-Mafia and Anti-Terrorism Directorate is now involved, with prosecutors in Reggio Calabria opening a probe into unauthorised access to a computer system of public interest.

Source

• TechCrunch — Revolut confirms customer data breach through fake government requests
• The Guardian — Revolut reportedly facing $3m ransom demand after hackers steal hundreds of customers' data