Story perspectives

Revolut Exposed Customer Data After Fake Government Email Request

By Drooid · Sep 14, 2026, 2:46 PM UTC · How we work

Summary

Revolut Data Breach

Revolut transferred sensitive customer data to an unauthorized third party after a fake government email request.
Exposed data included passports, driver’s licences, verification selfies, full account statements, IBANs and Bitcoin transaction histories.
Revolut blocked the email address, alerted the agency, law enforcement and regulators, and notified affected customers.
Attackers posted sample data and demanded 10,000 Bitcoin, about $782 million, as ransom.
Crypto researcher ZachXBT said the scam appeared to target high-net-worth customers.

Summary

Revolut Pursues Licence

Revolut is applying for a “lean bank” licence from the Bank of Israel.
Israeli regulators view Revolut as a catalyst to challenge the nation’s highly concentrated banking sector.
Authorities could tighten information-security requirements before approving Revolut’s banking licence.
A recent breach may erode Israeli consumer confidence in Revolut ahead of its market launch.
Thousands to tens of thousands of Israelis abroad already hold Revolut accounts despite no local operations.

History

Historical Context

The 2017 Equifax data breach, revealed in September, exposed personal records of millions and triggered a $700 million settlement. Equifax, the Federal Trade Commission, and the Consumer Financial Protection Bureau reported that 147 million Americans suffered identity theft risks, prompting stricter credit-reporting rules. Similarly, Revolut’s 2024 leak of passports, driver’s licences, and Bitcoin transaction data to a spoofed government email mirrors Equifax’s phishing-based intrusion, raising regulator scrutiny. Consequently, Israeli authorities now consider tightening information-security mandates for Revolut’s lean-bank licence, echoing post-Equifax reforms that reshaped global data-protection policies.

1 of 3

Revolut Data Breach

Revolut transferred sensitive customer data to an unauthorized third party after a fake government email request.
Exposed data included passports, driver’s licences, verification selfies, full account statements, IBANs and Bitcoin transaction histories.
Revolut blocked the email address, alerted the agency, law enforcement and regulators, and notified affected customers.
Attackers posted sample data and demanded 10,000 Bitcoin, about $782 million, as ransom.
Crypto researcher ZachXBT said the scam appeared to target high-net-worth customers.

1 / 3