Revolut Data Breach Exposes Customer Information; Ransom Demand Reported
Revolut confirms data breach via impersonation scam
Attackers used a fake government email to trick Revolut into sharing sensitive customer data. The stolen information includes personal details and financial records.
Key details of the incident
- Attackers posed as a government agency to pass security checks and request customer data.
- Data exposed includes names, dates of birth, addresses, phone numbers, emails, and copies of passports or driving licenses.
- Revolut states a "very limited" number of customers are affected, but does not specify a figure.
- A ransom demand of 10,000 BTC (about $780 million) has been reported to stop further leaks.
Revolut's official statement
Revolut confirmed in a statement that an unauthorized third party used a legitimate government agency email in a sophisticated impersonation scam. The bank blocked the address, alerted regulators, and said systems and customer funds remain unaffected. Impacted individuals have been contacted directly.
Reports from analysts and affected users
Social media posts suggest attackers are releasing stolen details and demanding ransom. Some observers, like crypto analyst Max Karpis, doubt the ransom demand's feasibility, noting such a payment would be easily traced. On-chain investigator ZachXBT indicated attackers may have targeted wealthy customers. Former Mt. Gox CEO Mark Karpelès revealed he was among those affected, with transaction histories potentially exposed.
Confirmed facts from the investigation
The breach involved an impersonation scam using a government domain. Types of data compromised are confirmed. Revolut has responded by notifying authorities and affected customers.
Unanswered questions and doubts
It is unclear if the ransom demand is genuine or if Revolut will negotiate. The exact number of affected customers is not disclosed. The authenticity and full scope of the circulating material have not been verified by Revolut.
Impact on customer privacy and security
The incident highlights risks to personal data in financial services. Exposed information could be used for identity theft, affecting customer trust and security.
