Hackers demand 10,000 Bitcoin from Revolut following data breach

Fintech tricked into responding to fake government information requests

British fintech Revolut is facing a $782m Bitcoin ransom demand from hackers who claim to have obtained sensitive customer information.

Revolut recently disclosed a security incident in which an unauthorised third party obtained sensitive customer information by sending fraudulent requests from the email domain of a legitimate government agency.

People claiming responsibility for the incident have posted samples of the allegedly stolen information across several Telegram groups and the material appears to include details belonging to prominent individuals, including business leaders, sports professionals and performing artists.

The attackers have threatened to publish additional information "every day" unless Revolut pays a ransom of 10,000 Bitcoin – currently worth more than $782m.

The company has not provided a full breakdown of the information accessed. However, the challenger bank has contacted 680 people to warn then that data including identity documents, postal and email addresses, facial verification image and phone numbers have potentially been exposed.

Several notable figures have had their personal information leaked by the hackers following the data breach. The group is threatening to release more unless it receives payment from Revolut.

The notices also indicate that account statements, withdrawal records and full transaction histories were among the exposed information.

Attack exploited trust in government email

Revolut said the incident involved a "sophisticated external impersonation scam".

An unauthorised party used an email address associated with a genuine government agency to submit fraudulent requests for customer information.

The company did not identify the agency involved but said it had informed the organisation and relevant enforcement agencies, data protection authorities and financial regulators.

A Revolut spokesperson said the company blocked the address as soon as the activity was detected and had contacted affected customers directly.

"Revolut systems and customer funds are unaffected," the company said.

The breach comes at an important time for Revolut.

The London-based fintech has been expanding internationally, including in markets such as France, Mexico, India, and the United Arab Emirates.

Earlier this month, the US Office of the Comptroller of the Currency gave conditional approval for Revolut to establish a national bank in the US. The company is reportedly considering a potential stock market listing that could value it at up to $200bn, considerably above its $75bn private valuation in November.

Malicious requests from trusted infrastructure

The breach illustrates the difficulty of distinguishing malicious requests from legitimate communications when attackers can operate from trusted infrastructure.

Patricia Titus, Field CISO at Abnormal AI, described the incident as a failure of trust rather than a conventional technical compromise.

"The company handed over passports, selfies, IBANs, and Bitcoin transaction histories because one email came from inside a real government domain and passed every authentication check," she said.

"No malware. No stolen credentials. Just a request that looked legitimate and a process built to comply once it did. This is the gap most security programs still don't close."

"Digital signatures on government requests have been proposed for years and mostly ignored. They still wouldn't stop a compromised account operating inside legitimate infrastructure. Behavioural detection and process discipline have to fill that gap together."

Muhammad Yahya Patel, vCISO and cybersecurity adviser at Huntress, said the incident raised questions about how financial institutions verify requests for highly sensitive information.

"For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high," he said.

"The question isn't why an attacker tried this. It's why a regulated financial institution handling highly sensitive data didn't have sufficiently rigorous verification controls to catch it."

Revolut said investigations into the incident are continuing.