Revolut Data Breach Exposes Bitcoin Transaction Records and Personal Data
Hackers leak sensitive customer information and demand payment to prevent further exposure.
1The Breach Overview
Hackers have started leaking sensitive Revolut customer data, including identity documents, verification selfies, and Bitcoin transaction records. The attack originated from fraudulent requests made via a spoofed government agency email domain. While Revolut confirms no direct system compromise or fund losses, the exposure of personal and financial data poses significant risks. The company has blocked the attacker's email and alerted authorities.
2Nature of Exposed Data
The leaked information includes comprehensive Bitcoin transaction histories, account statements, IBANs, and withdrawal dates. Personal details like phone numbers, addresses, full names, and birth dates were also compromised. This combination creates unique risks beyond typical exchange hacks, as it links individuals directly to their crypto activities. No private keys or customer funds were stolen in this incident.
3High-Profile Victims
Reports indicate that prominent individuals, including tennis player Shevchenko and Gamdom/Skinscom CEO Römer, are among the affected customers. Attackers are specifically threatening to release more data on notable clients unless Revolut pays their demands. The breach has moved sensitive information to jurisdictions outside UK and EU regulatory oversight, complicating response efforts.
4Attack Methodology
The well-planned spoofing attack bypassed security by mimicking legitimate government communications. Attackers gained access through fraudulent information requests sent via what appeared to be official agency emails. Revolut's systems weren't directly hacked, but the sophisticated social engineering approach successfully extracted customer data. The company has since implemented additional verification measures for such requests.
5Customer Impact
While Revolut states the number of affected customers is small, they haven't disclosed exact figures. The primary risk isn't asset theft but potential targeted phishing and social engineering attacks using the exposed data. Customers with Bitcoin transaction histories face particular exposure, as their financial activities can now be directly linked to personal identities.
6Regulatory Response
Revolut has notified multiple authorities including data protection agencies, financial regulators, and law enforcement across relevant jurisdictions. The breach highlights challenges in cross-border data protection, especially when information moves outside EU/UK regulatory frameworks. This incident may prompt stricter verification requirements for financial information requests.
7Industry Implications
The breach occurs amid Revolut's expanding crypto services, raising questions about security practices in fintech-crypto integrations. Unlike traditional exchange hacks targeting funds, this attack focused on personal data linked to crypto activities. It demonstrates how financial and identity data combined create new vulnerability vectors in digital asset services.
8Ongoing Risks
Attackers continue threatening further data leaks unless their demands are met. For affected users, the exposure creates long-term risks of identity theft and financial fraud. The incident underscores the importance of robust data protection in fintech, particularly for services handling both traditional finance and cryptocurrency operations.