Revolut Data Exposure Appears Limited to a Small Group of Users, Researcher Says

Highlights:

• Revolut’s recent data exposure appears small, with around five users publicly linked to the incident so far.
• The case came from a fake government email request, not from hackers breaking into Revolut’s systems.
• Known cases seem tied to EU users, but Revolut has not confirmed the full number affected.

Revolut’s recent customer data exposure appears to have affected a relatively small group of users, though the company has not yet confirmed the exact number. New details shared by researcher Max Karpis suggest that around five people can currently be linked to the incident through public disclosures and direct contact.

Karpis posted the follow-up on September 13 after the case drew wider attention online. He said the figure should not be treated as the final total because Revolut has only described the affected group as a “limited number” of customers. The incident began after Revolut received a fraudulent information request from an unauthorized mailbox operating on a real government domain. 

Because the email came from a legitimate domain and passed standard authentication checks, the request appeared genuine. Revolut sent customer files before later contacting the agency and learning that the request was bogus.

Follow-up: this was not a Revolut hack

The story has been widely picked up and argued over. Reuters, TechCrunch and Bloomberg now have the same spokesman line that first circulated on Friday. Most of the noise still calls it a hack. It was not.

Nobody broke into Revolut’s… https://t.co/KqehBWYZaN

— Max Karpis (@maxkarpis) September 13, 2026

Around Five Users Can Be Publicly Identified

Karpis said several people have now identified themselves publicly as recipients of Revolut’s notice. He mentioned Marc Zeller, who said he received the notification, while former Mt. Gox CEO Mark Karpelès also circulated the same email and has been reported as an affected customer. On-chain investigator ZachXBT was among the first to draw attention to the case.

Karpis added:

“Putting the public identifications together with the person who contacted me, I can count about five people. That may be a fraction of the true figure. Revolut still will not go beyond ‘a limited number’.”

The available information therefore points to a small known group, but the real number remains unclear. ZachXBT previously said the incident appeared limited in size and may have focused on higher-value users. Revolut has not publicly confirmed that characterization.

Revolut Systems Were Not Hacked, Karpis Says

Karpis also stressed that the case should not be described as a Revolut hack. No attacker broke into Revolut’s internal systems, and no customer funds were reported missing. Instead, the failure happened during the handling of an external government information request.

He wrote:

“Nobody broke into Revolut’s systems. No funds moved. An unauthorised mailbox on a real government domain passed the usual email checks.”

The exposed records could include identity documents, contact details, account statements, withdrawal records and full transaction histories, including Bitcoin activity. Revolut said login information, biometric face templates and customer funds were not involved.

Questions Remain Over Verification Process

The latest update raises fresh questions about how the request was checked before Revolut shared customer information. Karpis said the government agency failed to prevent unauthorized access to its email domain. At the same time, Revolut did not fully verify who was behind the mailbox before releasing sensitive customer records.

Revolut later blocked the sender and reported the incident to the government agency, police and regulators. The company has not named the agency because the investigation is still ongoing. Karpis said the known cases appear to involve users in the EU, although Revolut has not confirmed where the affected customers are based.