Revolut confirmed a serious breach affecting customer data after scammers used an email account on an official government domain to send what looked to be a valid request for user information. The company satisfied the request and revealed confidential information before uncovering the fraud.

The exposed data appears to include financial records and KYC records, some of which are now accessible online as attackers demand payment. Even though internal records were not directly affected, the incident exposes serious flaws in how banking companies verify law enforcement requests.

A Fake Request That Looked Completely Legitimate

Revolut's network did not need to be breached by the attackers. They used a far simpler method, i.e., a fake government request sent from an illicit email account on an official government domain.

Importantly, the email passed domain authentication checks, which allowed compliance personnel to release the records and view the request as legitimate. After the data had been transferred, the fault was found.

Revolut has since reported the breach to authorities and blacklisted the sender's address, maintaining that core internal systems and account balances remain uncompromised.

The Exposed Information Goes Beyond Basic Account Details

Since these identities cannot be easily reset or changed, the disclosure of KYC verification documents, such as passports, national IDs, and onboarding selfies, poses a significantly greater danger than a typical data leak.

There were reportedly some financial records as well. These could include transaction history, IBANs, account statements, and withdrawal data. Cryptocurrency users are especially worried about their exposure because Bitcoin transaction data could be connected to a person's verified identity.

Revolut has refused to provide the precise number of victims, downplaying the scale as "isolated" and reiterating that customer funds are secure.

Source: Telegram - ZachXBT

Stolen Information Is Already Being Used for Extortion

The threat actors published sample records to prove possession, allegedly including files tied to professional tennis player Alexander Shevchenko, former Mt. Gox CEO Mark Karpelès and Gamdom CEO Felix Römer, and threatened further leaks if their ransom is not paid.

The attackers have turned the hack into an active extortion attempt by posting sample files to prove ownership and threatening to leak more details if payment is not made.

ZachXBT, a cryptocurrency investigator, has also been speaking out about the situation. Although Revolut has not verified this judgment, he suggested that the attackers might have acquired information on high-value Revolut customers.

The public's criticism of Revolut's verification methods has increased due to the inclusion of notable individuals and cryptocurrency executives in the hacked data.

Pretty bad pic.twitter.com/OQmzPM2Y3u

— Mark Karpelès (@MagicalTux) September 12, 2026

Revolut Faces Questions Over KYC & Its Response

The lack of secondary verification before transferring critical KYC files is the main source of user outrage rather than the phishing email's intricacy.

It makes sense that customers who have already provided a financial platform with their passports, photographs, and transaction records would want to know what checks are made before that data is shared with a third party.

According to Revolut, the request seemed real as it originated from a government site that has been verified. However, consumers are now wondering if domain authentication should have been enough, as identity documents and comprehensive financial records were being requested.

After ZachXBT questioned their public remarks, Revolut allegedly blocked him on X, which further inflamed criticism. That move has drawn more criticism for a company that is already dealing with issues from cryptocurrency users regarding transparency.

Idk why I am blocked by both Revolut accounts. pic.twitter.com/wLd3IdmSF9

— ZachXBT (@zachxbt) September 12, 2026

While Revolut insists no funds were stolen and that the rogue email address is now blocked, these measures cannot claw back exposed data. For affected clients, government identity papers and transaction histories are now permanently out in the wild.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. $90K Crypto Loss After Chrome Extension Hack
2. Liquid Network Loses $320M in Security Breach
3. Nasdaq Invests $100M in Kraken Parent Payward
4. Trezor Email Breach Sparks Crypto Phishing Fears
5. Osmosis Freezes $1.79M After nBTC Exploit

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.