Revolut confirms data breach as hackers leak customer KYC data daily in extortion bid

Fintech company Revolut has confirmed a data breach. Attackers reportedly abused a legitimate government email domain to submit fraudulent customer data requests, bypassing verification to obtain passports, verification selfies, account statements and transaction records. Since September 13, the hackers have been publishing customer KYC data daily on Telegram in an extortion attempt that has already affected high-profile clients.

Confirmed

• Revolut confirmed the breach, saying fraudsters used a legitimate government agency email domain to submit fake data requests that bypassed verification.
• Reported leaked content includes passports, verification selfies, account statements and transaction records.
• According to French user KuptoKosmos, since September 13 a group of attackers has been posting Revolut customers' KYC data one by one on Telegram, threatening to continue daily and release internal data unless Revolut pays.
• Victims already exposed include tennis player Shevchenko and Gamdom/Skinscom CEO Römer.

Unconfirmed

• Security outlet International Cyber Digest says it is in contact with the hackers, who claim the operation lasted six months and is larger than publicly known; this remains unverified.
• The hackers also claim to have breached multiple Italian law enforcement systems, holding 147GB of internal data used to send the data requests to Revolut — again only the attackers' word.

Why it matters

• The attack path exposes a process flaw: impersonating legitimate government email domains to file data requests, a risk for any company relying on similar identity-verification mechanisms.
• The daily KYC leakage inflicts direct and ongoing privacy harm, has already hit prominent clients, and may escalate if ransom talks stall.

2026-09-14 ~ 2026-09-15 · 5 related posts

• Hackers leak Revolut customer data, name high-profile clients, demand ransom — RSync25 · 2026-09-14
• Revolut hit by alleged mass KYC leak as attackers publish customer IDs daily on Telegram — cyb3rops · 2026-09-14
• [source] Revolut Confirms Data Breach After Fraudsters Fake Government Data Requests — TechNadu · 2026-09-14
• Revolut hackers claim they also breached Italian law enforcement, holding 147GB of data — jedisct1 · 2026-09-15

1 near-duplicate retellings: CarissaVeliz