Revolut has confirmed a customer data breach affecting roughly 680 accounts after attackers exploited a genuine — but compromised — Italian government certified-email (PEC) address to submit fraudulent requests for customer information. The requests passed Revolut’s technical authentication checks because they arrived from a real government domain, and Revolut says it was the target of what it calls a “sophisticated external impersonation scam.”
Exposed data reportedly includes passport and other identity documents, home addresses, bank account numbers, and — for affected customers who held crypto balances — bitcoin transaction histories. Revolut has around 80 million customers globally, so the 680 affected accounts represent a small fraction of its user base, though the sensitivity of the exposed data (identity documents plus crypto activity) makes this more serious than a typical low-impact leak.
Since discovering the deception, Revolut says it blocked the compromised email address and alerted the relevant government agency, law enforcement, data-protection regulators, and financial supervisors. The UK’s Information Commissioner’s Office has confirmed it received a report and is assessing it; Italian authorities have asked banks operating in Italy to review their own data-access controls, and Italian police have opened an investigation. A threat group has reportedly demanded 10,000 BTC and threatened to publish more stolen customer data if it isn’t paid.
What it means for users: if you’re a Revolut customer, this breach affected a small, specific group of accounts rather than the whole user base, but it’s a reminder that even “verified” inbound requests can be spoofed — watch for unsolicited contact referencing your Revolut account, and enable extra account-security steps (2FA, transaction alerts) if you haven’t already. EU/EEA users can also flag concerns to their national data-protection authority in parallel with any Revolut support channel.
Source: https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/