Hackers Demand $3 Million Ransom From Revolut

Revolut’s mobile-first model has helped it reach more than 80 million customers and operate as a bank in over 30 countries, concentrating identity, account and transaction data in a fast-growing platform. The risk is not new: a September 2022 social-engineering attack exposed data tied to 50,150 customers worldwide, including 20,687 in the European Economic Area. The repeated failures sharpen concern that regulatory penalties alone cannot correct weaknesses in verification, access controls and security governance.

On Sept. 11-12, 2026, Revolut notified affected customers that it had fulfilled fraudulent information requests sent from an unauthorized mailbox inside an official government domain. The messages carried valid domain-authentication credentials; records disclosed may have included passports, verification selfies, IBANs, withdrawal data and full transaction histories, including Bitcoin activity. Revolut said its systems and customer funds were unaffected, but did not disclose the number of people involved. The Bank of Lithuania’s separate €3.5 million anti-money-laundering fine on April 8, 2025, underscores how sanctions have yet to dispel broader control concerns.

Revolut, a UK-based fintech company offering banking and payment services through its mobile app, has a large customer base that makes any alleged data exposure a significant cybersecurity concern. Listings of financial records on dark-web forums can raise the risk of fraud and identity theft, while also testing customer confidence and drawing scrutiny of a company’s data-protection controls.

As of Aug. 3, 2026, a hacker claimed to be selling 75 million purported Revolut customer records on the dark web for $500. Revolut said it compared and validated the material and found no evidence that its systems had suffered a data breach. The company concluded that the dataset was highly likely to have been fabricated rather than obtained from genuine customer records.