Revolut customer data leak: What is known so far

Unidentified attackers tricked UK-based digital bank Revolut into releasing sensitive client data and are now publishing the stolen records, while reportedly threatening to continue doing so unless the fintech pays a ransom of more than 10,000 bitcoin.

At current market rates, that demand is worth roughly $780 million.

Revolut has neither confirmed the ransom demand nor verified any of the leaked material now circulating. Many on social media have questioned whether the demand is genuine. Max Karpis, a Revolut investor and crypto analyst, noted that such a large payment would be easily trackable, making it extremely hard to cash out.

After Revolut’s data breach, the company has reportedly received ransom demands: pay up, or they'll release customer files.

People claiming they hold the pack are posting ID copies and selfies on Telegram and saying they will drip more every day. One figure doing the rounds is…

— Max Karpis (@maxkarpis) September 14, 2026

Attacker posed as government agency

Over the weekend, an unidentified party targeted Revolut by using a legitimate government agency domain to bypass the bank’s security checks and request customer data.

Information that may have been exposed includes names, dates of birth, addresses, email addresses and phone numbers, along with copies of passports and driving licences.

Revolut said the number of affected customers was “very limited” but did not provide a specific figure.

Customer notifications reportedly referenced account statements, IBANs, withdrawal records and transaction histories, including bitcoin activity.

Posts on X claim the attackers are demanding 10,000 BTC in return for not releasing further customer information.

Revolut has not confirmed that figure, and its public statements so far have only acknowledged that customer data was disclosed.

The bank has also not said whether it plans to negotiate with the attackers or whether the material circulating online is authentic or represents the full stolen dataset.

Former Mt. Gox CEO among victims

Reports indicate that some affected customers may be high-profile or wealthy individuals.

Former Mt. Gox CEO Mark Karpelès has disclosed that he was one of those impacted.

According to The Block, Karpelès shared the notification he received from Revolut, which stated that account statements, IBANs, withdrawal records and full transaction histories — including bitcoin activity — may have been exposed.

On-chain investigator ZachXBT has suggested that the attackers may have deliberately targeted wealthy Revolut users and that the breach appears to involve a relatively small number of high-net-worth clients.

Revolut says customer funds are safe

In a statement to Protos, Revolut said, “Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.

“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators.

“Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support.”

This indicates the incident was mainly a data disclosure event rather than a direct attack on customer accounts or crypto holdings.