Revolut Customer Records Exposed: Attackers Demand 10,000 BTC

Revolut disclosed sensitive customer records to an unauthorized party after fraudulent data requests arrived from an email address on a legitimate government domain, the company confirmed on Saturday, September 12. The exposed material may include identity documents, verification selfies, account statements, and transaction histories containing Bitcoin activity.

Revolut told TechCrunch that a limited number of customers were affected and that its systems and customer funds remained unaffected. The incident raises privacy concerns because identity records and Bitcoin transaction histories may have been disclosed to an unauthorized party.

So what has happened? Someone impersonated a government agency using an address on that agency’s own domain, and the request cleared Revolut’s checks before it was identified as fraudulent. Customer information was disclosed during that period.

BREAKING: Revolut attackers demand 10,000 BTC ransom, threatening to leak stolen customer data.

The threat actors who allegedly tricked Revolut into handing over sensitive customer data by posing as a government are now publishing information belonging to high-profile clients.… https://t.co/kJi58fAHaa pic.twitter.com/5IIaCHHOYT

The notification Revolut emailed to affected customers listed birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licenses. Verification selfies, account statements, and transaction histories may also have been disclosed, the bank said.

Revolut said it blocked the sender’s address after detecting the scheme and alerted the government agency concerned, as well as law enforcement, data protection authorities, and financial regulators. A company spokesperson characterized the episode as an external impersonation scam and said the company’s systems and customer funds were unaffected.

Crypto investigator ZachXBT publicized the notice in a Telegram post and added several items Revolut’s own notification did not list: IBANs, withdrawal records, occupations, and transaction history covering Bitcoin. He assessed the incident as limited in scale and aimed at high-net-worth users.

Revolut has not disclosed an exact number of affected customers. The company also has not stated that crypto holders or wealthy customers were specifically targeted, so the assessment of the apparent target group remains separate from Revolut’s primary disclosure.

Bitcoin’s blockchain records transactions publicly, while personal details such as a passport or home address sit outside the network. Financial intermediaries can connect those different types of information through the records they collect. This incident illustrates the privacy concern when identity documents are disclosed alongside Bitcoin transaction histories.

Information that includes names, addresses, contact details, and transaction histories can create a more detailed picture of an affected customer than any one category of data alone. The reporting does not document a follow-on misuse of the information in this incident, but it highlights the sensitivity of records that link personal information with financial activity.

this is actually insane, these types of things sound inconvenient but they can lead to home invasions and losing millions

at this point, it should be made literally illegal to do anything but ZK-based KYC if KYC (which doesn't work) must be done

we have the tech https://t.co/Bl80YbFMAR

Revolut’s response included blocking the sender, notifying regulators, and contacting affected customers directly. The episode also focuses attention on how financial institutions assess requests that appear to come from government agencies and on the scope of information released when those requests are accepted as legitimate.

For crypto users who use Revolut or similar platforms, the incident is a reminder that crypto privacy can depend on how intermediaries handle identity documents, account records, and transaction histories. Revolut said customer funds remained safe, while the disclosure shows that fraud involving an apparently legitimate government-domain email can still expose sensitive customer data.

Discover: The Best Token Presales

The post Revolut Customer Records Exposed: Attackers Demand 10,000 BTC appeared first on Cryptonews.