Revolut Data Breach: Your Files Are Public, and Here Is What You Can Do

When a copy of your ID document, your verification selfie and your complete Bitcoin transaction history all sit in one package in the hands of strangers, a new password achieves almost nothing. That has been the position of the Revolut customers who received a breach notification since September 14, 2026: the stolen documents have been published since the early hours of that day. Four things matter now. Establish in writing how far your own exposure goes. Close the routes through which a copy of an ID document turns into money. Take the link between your home address and your crypto holdings seriously. And enforce your rights against the bank while the deadlines are still running. This piece builds on our first assessment. Whether you are among the affected customers at all, and what role your Bitcoin history plays in the incident, is covered in Revolut data breach: am I affected, and what about my Bitcoin history? from September 12. This article deals with the stage after that: the details are out, and that changes the question of what to do. Revolut data breach: what to do now that the files are being published Until the weekend, the security incident was an outflow of customer data. Since the night of September 14, Cointelegraph has reported that copies of identity documents and verification selfies belonging to Revolut customers have surfaced online. According to the outlet, the attackers are announcing on Telegram that they will release further data sets every day until Revolut pays. One affected customer confirmed to Cointelegraph that the published details match the documents held on file at Revolut, and that the neobank wrote to him on Friday. One point matters for the assessment: the existence of a ransom demand is the attackers' own account, relayed by a trade publication citing a Telegram post. Revolut itself does not confirm any such demand. A specific Bitcoin sum is also circulating on aggregator sites as the alleged ransom. There is no solid evidence for that figure, which is why it does not appear as fact in this article. The practical difference from last week is considerable nonetheless. As long as a data set sits only with one criminal group, it needs a buyer before it can be used against you. Once it is publicly retrievable, that intermediate step falls away, and the number of possible fraudsters grows from one group to anyone who finds the file. Which data fields Revolut lists in its customer email The trade publication BleepingComputer quotes the notification Revolut sent to affected customers verbatim. According to that text, the incident covers the full name, date of birth, occupation, postal address, email address and telephone number.