Revolut Attackers Start Leaking Customer Data and Threaten More Releases

Highlights:

• Attackers have started leaking Revolut customer data online and are threatening more releases unless the company pays.
• The exposed information includes identity documents, financial records and Bitcoin transaction histories from some affected customers.
• Revolut says hackers never breached its systems, customer funds remained safe, and only a limited number of users were affected.

Attackers linked to the recent Revolut data exposure have reportedly started publishing sensitive customer information online. The group is also threatening to release more records unless Revolut pays.

International Cyber Digest reported the latest development on September 13. The cybersecurity outlet said the leaked information is linked to several Revolut customers, including tennis player Alexander Shevchenko and Felix Römer, CEO of crypto casino Gamdom. The attackers claim they have more customer data and plan to release further material. However, the total amount of information they hold and the number of customers involved remain unclear.

‼️ BREAKING: The threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom.

They want Revolut to pay up. They say they'll… pic.twitter.com/obuVOOABx7

— International Cyber Digest (@IntCyberDigest) September 13, 2026

Attackers Threaten Daily Revolut Customer Data Leaks

International Cyber Digest said the attackers are trying to pressure Revolut into paying. The group reportedly plans to publish more customer records and other information in the coming days.

In a message shared by the attackers, they said:

“We’re going to start releasing more and more data everyday until revolut pays for leaking their customers.”

The attackers have also accused Revolut of mishandling private customer information. Among their claims, they allege that the company provided sensitive records in response to requests from countries outside the relevant jurisdiction.

Those claims have not been independently confirmed. The latest releases reportedly include sensitive personal information. Earlier details showed that the exposed records could include identity documents, verification selfies, names, dates of birth, addresses, contact information and financial records. Some customers also had full transaction histories exposed, including Bitcoin activity.

Fake Government Request Led to Revolut Data Exposure

The incident began after an unauthorized person used an email account on a legitimate government agency domain to request customer information. Because the email came from a real government domain and passed normal authentication checks, the request appeared genuine. Revolut later discovered that it was unauthorized.

The company described the incident as a sophisticated external impersonation scam rather than a hack of its own systems. Revolut said its systems and customer funds were not affected. After discovering the problem, Revolut blocked the sender. It also contacted the government agency, police and financial regulators.

Earlier Reports Pointed to a Small Known Group

Before the latest data releases, researcher Max Karpis said around five people could be publicly linked to the incident. However, he warned that the number may represent only a fraction of the actual group. As Crypto2Community previously reported, Revolut has only said that a “limited number” of customers were affected. The company has not publicly given an exact figure.

Karpis also stressed that attackers did not break into Revolut’s internal systems. He wrote:

“Nobody broke into Revolut’s systems. No funds moved. An unauthorised mailbox on a real government domain passed the usual email checks.”

Revolut also said login information, biometric face templates and customer funds were not exposed. The known cases appeared to involve EU users, according to Karpis, although Revolut has not confirmed where the affected customers are based. The latest leak now raises a separate concern for customers whose information may still be held by the attackers. Identity documents, selfies and financial records could be used in phishing or impersonation attempts.

Follow-up: this was not a Revolut hack

The story has been widely picked up and argued over. Reuters, TechCrunch and Bloomberg now have the same spokesman line that first circulated on Friday. Most of the noise still calls it a hack. It was not.

Nobody broke into Revolut’s… https://t.co/KqehBWYZaN

— Max Karpis (@maxkarpis) September 13, 2026

The group has not revealed how much customer data it still holds. However, the attackers say they will keep releasing more records, while Revolut says hackers never breached its systems and customer funds remain safe.