Revolut Attackers Warn of Ongoing Daily Customer Data Leaks

Threat actors behind a reported Revolut customer-data leak have begun sharing stolen personal information online and say they will publish additional details each day until the company “pays,” according to statements circulated on Telegram and an X post by International Cyber Digest. The materials reportedly include facial-verification images and scanned identity documents, raising concerns about identity theft and fraud risk. Revolut previously told customers that the exposed dataset includes full names, dates of birth, occupation, contact information, account statements, and complete transaction histories—along with records of Bitcoin transactions—following what the company described as a “sophisticated external impersonation scam.” Revolut also said its systems and customer funds were unaffected and that the breach involved a “limited number” of customers. Key takeaways Attackers say they will release more Revolut customer data daily until “revolut pays,” according to Telegram messages discussed in social posts. Reportedly exposed items include selfies and copies of identity documents, which could materially increase identity theft and account-takeover risks. Revolut states the leak stems from an external impersonation scam using a legitimate government-domain email address and says customer funds and systems were unaffected. Customers mentioned in the leaked information include at least one Revolut user contacted by the company, based on confirmation provided to Cointelegraph. Leak escalates with daily release threats International Cyber Digest, in an X post shared on Sunday, said the newly leaked materials include selfies and identity documents belonging to tennis player Alexander Shevchenko and Felix Römer, CEO of online crypto casino Gamdom. The same X post points to Telegram messages in which the attackers vowed to keep releasing additional data every day until “revolut pays.” Such “data ransom” behavior—where perpetrators threaten incremental public disclosure—can heighten pressure on affected individuals and complicate mitigation efforts, since victims may face a moving target as new documents and personal details become available. What Revolut says was exposed In its earlier customer communication, Revolut said the compromised information included both identity and financial records. The company reported that the leak covered personal details (including full name, date of birth, occupation, and contact information), as well as account statements and full transaction histories, including entries related to Bitcoin transactions. Revolut attributed the incident to a “sophisticated external impersonation scam,” in which an attacker used an email address from a legitimate government agency domain to submit fraudulent requests for information. Revolut also emphasized that the breach affected a “limited number” of customers and that its systems and customer funds were not impacted. While Revolut’s characterization centers on information-access methods rather than internal system compromise, the scale and sensitivity of the data described—particularly identity verification materials—still make the impact significant from a cybersecurity and personal-safety perspective.