Revolut has confirmed that the sensitive data of 680 customers was compromised after it responded to a fraudulent request sent from an email address that appeared to belong to a legitimate government authority. The data involved includes names, addresses, telephone numbers, copies of passports and driving licences, verification selfies, bank statements, IBANs and complete transaction histories, including those involving Bitcoin. This was not a direct attack on the company’s systems, but a sophisticated case of impersonation: the person who sent the request had genuine domain credentials, and Revolut treated it as a legitimate request from law enforcement, providing the data without further verification.
What makes this case particularly sensitive for the Italian public is the origin of the PEC email address used for the scam, which, according to various accounts, appears to be linked to the Guardia di Finanza or the Financial Intelligence Unit of the Bank of Italy. Having obtained the data, the perpetrators of the attack moved on to extortion: they are demanding 10,000 Bitcoin – approximately $780 million – from Revolut, threatening to publish all the material on Telegram should the demand be refused. The UK Information Commissioner’s Office has launched an investigation after Revolut itself reported the incident to the regulator in recent days.
The situation risks being even more serious than has been reported so far. Cybersecurity expert Matteo Flora has pointed out that the breach is not simply a data leak, but the direct consequence of a compromised certified email account (PEC) attributed to law enforcement agencies: a detail that shifts part of the responsibility from Revolut’s technical defences to the procedures for verifying government requests. Following the initial disclosure, the attackers themselves have come forward again, claiming to have also compromised systems belonging to the Italian police, and asserting that they are in possession of 147 gigabytes of stolen material: a claim that has not yet been independently confirmed.
The data breach at @Revolut appears to be much, much more serious than has been reported.
If the attacker’s claims are correct, Revolut was not ‘hacked’, but responded to a certified email (compromised by the attacker) sent directly by the police, to a… https://t.co/YRoAuDlfWB— Matteo G.P. Flora (@lastknight) 15 September 2026
For the crypto sector
this incident is the latest in a series of recent breaches involving sensitive user data: the SafePal wallet had already exposed the details of 39,798 customers, whilst a supplier linked to Trezor had been hit, resulting in the exposure of around 67,000 US users. On-chain investigator ZachXBT has speculated that the attack on Revolut may have specifically targeted users with substantial holdings in Bitcoin and Ethereum – precisely the profiles most at risk when KYC data falls into the wrong hands. This case highlights an often-underestimated risk: the more documents and transaction histories platforms collect to comply with anti-money laundering obligations, the more that data becomes a valuable target for those seeking to directly target the wallets of the wealthiest users.
There is a bitter irony in all this: KYC checks exist to protect the financial system from money laundering and crime, yet here they have become the very channel through which crime has entered. All it took was an email with the right header to bypass, in one fell swoop, firewalls, encryption and compliance procedures that had cost years of investment. If the Bitcoin ransom demand were actually to materialise, Revolut would find itself having to choose between paying millions to criminals or having the identity documents of hundreds of customers exposed online: a choice that no cyber security policy can truly prepare one to face.
