Revolut has confirmed a data breach affecting around 680 customers, with an alleged hacker reportedly demanding a USD 3 million ransom.
The UK-based financial technology company disclosed last week that it had fallen victim to an impersonation scam in which an unauthorised third party used a compromised Italian government email domain to request customer information from Revolut staff. According to the company, systems and customer funds were not affected, and the number of individuals impacted represents a small fraction of its customer base of roughly 80 million people worldwide.
Breach linked to suspected crypto holdings
The exposed data is understood to have been concentrated among customers suspected of holding cryptocurrency, rather than a random cross-section of Revolut's user base. One individual affected, Mark Karpelès, the former chief executive of the defunct bitcoin exchange Mt. Gox, said his personal details, including his home address, were among the information accessed. He said he had subsequently reported the matter to law enforcement in Japan, where he resides, and had raised concerns about his and his family's safety.
According to The Guardian, an alleged hacker has said that the stolen data will be published unless Revolut pays a USD 3 million ransom. Revolut has said it has not received any direct contact or ransom demand from the individuals or group making the claims. Separately, at least one affected customer has reportedly been approached directly and asked to pay USD 50.000 for the deletion of their own data, according to Karpelès, who said he had joined an online group of affected customers exchanging information about the incident.
The requested ransom payment has reportedly been structured through Monero, a cryptocurrency designed to obscure transaction records, which would make it difficult to verify whether any payment had been made or received.
Company response and wider context
In a statement, Revolut said it had identified a sophisticated external impersonation scam involving a legitimate government agency domain and had blocked the associated email address upon detection. The company said it had alerted the relevant government agency, along with law enforcement, data protection authorities, and financial regulators, and had contacted the affected customers directly to provide support.
The incident emerges as Revolut pursues a stock market listing. Founder Nik Storonsky has indicated that the company is considering a dual listing in London and New York, though it remains unclear what bearing, if any, the breach could have on those plans.
Impersonation of official government or institutional email addresses to extract customer data from financial institutions has become a recurring vector in social engineering attacks across the payments and banking sector, particularly where the targeted data can be linked to cryptocurrency holdings, given the difficulty of reversing crypto-related fraud once funds or information are compromised.
