Revolut’s Data Leak Wasn’t a Hack, It’s a Trick Fintechs Keep Falling For

Revolut warned customers on September 11 that a sophisticated impersonation scam had exposed their personal data. An unauthorized party used an email account within a legitimate government agency’s domain to request customer information. The message appeared genuine because it carried genuine domain authentication credentials, but it was not. The breach became public that night after Mark Karpelès and blockchain investigator ZachXBT shared the warning emails on Telegram. The exposed data reportedly included names, addresses, identity documents, KYC selfies, bank statements, and transaction histories. On September 13, attackers began releasing files and threatening daily leaks. A reported ransom demand of 10,000 BTC, worth about $780 million, followed. Revolut has not confirmed the demand or verified the leaked files. The community has been vocal about how it feels In a recent tweet by a cybersecurity reporting outlet, the threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom. This has drawn massive attention and market reaction. BREAKING: The threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom. They want Revolut to pay up. They say they’ll… pic.twitter.com/obuVOOABx7 — International Cyber Digest (@IntCyberDigest) September 13, 2026 Most of the reaction following this tweet has been about the data, not the attack. zkPassport says the problem starts at collection. Firms store identity data because states can demand it. Attackers then abuse that same process. The Revolut situation exposes a much bigger problem with how KYC works today. Companies collect and retain huge amounts of sensitive identity data which govts can request access to….Here, attackers reportedly exploited exactly that process. ZK can be part of the solution. https://t.co/qOjxoSMeZe — ZKPassport (@ZKPassport) September 14, 2026 Helius CEO Mert was blunter. He said leaks like this end in home invasions, and that ZK-based KYC should be the only legal form. One X user, Mayabayaa, said handing over customer data should carry real consequences. If not, firms will keep assuming they can ride out the fallout. giving away customer data just like that is a crime and we should really do something about it if we don’t do something, these companies will think they can always get away with this https://t.co/A8H288VrMc — mayabayaa (@mayabayaaa) September 14, 2026 Another user, Vweeter, tied the failure to ambition, arguing that Revolut’s push to become a bank is what created a file worth stealing in the first place.