“I have kids, we’re living together. My address is in those files, so of course I’m worried about this.” That is Mark Karpelès, former chief executive of the failed Mt. Gox bitcoin exchange, describing what it is like to be among the customers caught in the Revolut data breach. He has since contacted police in Tokyo, where he lives.
Revolut confirmed it handed sensitive customer information to an unauthorized third party after receiving fraudulent requests from a legitimate government agency email domain. The Guardian reported the compromised system was an Italian government one, used to contact Revolut staff and ask for personal customer details. A Revolut spokesperson called it “a sophisticated external impersonation scam.”
What was taken
A notification emailed to affected customers, reviewed by TechCrunch, listed birth dates, postal and email addresses, phone numbers and copies of identity documents such as passports and driver’s licenses. It said the data may also have included verification selfies, account statements and transaction histories.
The Guardian put the number at about 680 of Revolut’s 80 million customers, apparently people with suspected cryptocurrency holdings. Revolut had initially described only a “limited” number without giving a figure, and it declined to say which agency was involved or whether the incident was confined to one market. The company says it blocked the email address, alerted the agency, law enforcement and regulators, and that “Revolut systems and customer funds are unaffected.”
The crypto security researcher ZachXBT posted about Revolut’s email to customers late on Friday, September 11, and said the target appeared to be high-net-worth users.
A reported ransom demand
By September 17 the story had grown. The Financial Times, which has been speaking with one of the alleged hackers, reported a demand for $3 million, with a threat to publish the data otherwise. Revolut said it “has not received any direct contact or demand from the individuals or group making these claims.”
Karpelès said victims have gathered in a chat group on X, trading what they know. One of them, he said, got in touch with the purported hacker, who proved they held the person’s details and offered to delete them for $50,000. The ransom is also requested in Monero, which leaves no receipt. Karpelès does not think Revolut should pay, since nothing guarantees deletion. He also suspects he may have been targeted by mistake, thinking he was richer than he is. He said he was forced into bankruptcy after a high-profile court case in Japan.
The timing is awkward. Revolut has reportedly been weighing a public listing that could value it at as much as $200 billion, and founder Nik Storonsky told Les Echos there were plans for a dual listing in London and New York. Earlier in September the U.S. Office of the Comptroller of the Currency gave conditional approval for a Revolut national bank, which the company expects to launch in the first half of 2027. It is not clear how the breach will affect the stock market debut.
Sources
- Revolut confirms customer data breach through fake government requests | TechCrunch
- Revolut reportedly facing $3m ransom demand after hackers steal hundreds of customers’ data
