A Revolut spokesperson told The Guardian (17 September 2026) that Revolut had identified a sophisticated external impersonation scam in which an unauthorised third party used a legitimate government agency domain email to submit fraudulent requests for information; that on detection it immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators; that Revolut systems and customer funds are unaffected; and that it has contacted the limited number of impacted individuals directly. (source: The Guardian)

TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity). (source: TechCrunch with Revolut confirmation)

The Guardian reports the breach affected about 680 of Revolut's customers; OCCRP attributes that figure to a source familiar with the incident cited by Reuters.

Revolut has not published a number. (sources: The Guardian; OCCRP) OCCRP (17 September 2026) reports that a group calling itself 'iamnotavillain' demanded 6,000 Monero, worth about US$3 million, threatening to sell the data. (source: OCCRP)

A Revolut spokesperson told Reuters the company had received no direct contact or ransom demand. (source: OCCRP, citing Reuters)

Correction (22 Oct 2026): an earlier version presented the 680-account figure and a US$3 million ransom demand as established facts; they come from news reports, and Revolut has said it received no demand. (source: OCCRP, citing Reuters)

Correction (29 Oct 2026): removed a SecurityWeek link, details that came only from the hacker's own account as relayed by Hudson Rock, and an unattributed line from The Guardian.