Revolut confirms two customer data breaches in September

UK bank Revolut has disclosed that its customers experienced two data breaches this month, following a social engineering attack on DriveWealth, its former third-party US broker.

Revolut and DriveWealth jointly revealed the breach on Wednesday, which occurred on September 4 and September 5. According to reports, the compromised details include names, email addresses, ages, genders, citizenship information, postal addresses, and employment data.

Earlier in September, Revolut disclosed that attackers used an Italian government email to access company data.

JUST IN: Revolut is emailing customers about another data incident. This one is at DriveWealth, the US broker that used to handle Revolut’s US share trading.

DriveWealth says unauthorised access hit its systems on 4–5 September. The data taken is older customer-profile… pic.twitter.com/xPO7YbOk57

— Max Karpis (@maxkarpis) September 24, 2026

The newly disclosed breach does not include data from European Economic Area customers affected after 2023.

Neither Revolut nor DriveWealth has specified the number of impacted users or the details of the social attack.

Revolut emphasised that its core infrastructure, funds, and accounts were not affected.

Negotiations with Revolut ‘didn’t go as planned’

Reported ransom demands after the email attack ranged from $760 million in bitcoin to $3 million in Monero days later.

The hacker now claims that “negotiations didn’t go as planned” and has released the so-called “Italy Files,” containing data on 680 crypto whales.

Journalist Jason Mikula noted that the hacker is selling the data at a price 10 times lower than their ransom, suggesting “the group is struggling to monetize the data they have exfiltrated.”

The attackers are also reportedly offering impacted users, including Mt. Gox CEO Mark Karpelès, the chance to pay to prevent their information from being leaked.