Revolut Customer Records Exposed: Attackers Demand 10,000 BTC

Revolut disclosed sensitive customer records to an unauthorized party after fraudulent data requests arrived from an email address on a legitimate government domain, the company confirmed on Saturday, September 12. The exposed material may include identity documents, verification selfies, account statements, and transaction histories containing Bitcoin activity.

Revolut told TechCrunch that a limited number of customers were affected and that its systems and customer funds remained unaffected. The incident raises privacy concerns because identity records and Bitcoin transaction histories may have been disclosed to an unauthorized party.

So what has happened? Someone impersonated a government agency using an address on that agency’s own domain, and the request cleared Revolut’s checks before it was identified as fraudulent. Customer information was disclosed during that period.