Loading story…
A threat actor has advertised an alleged Revolut customer database for sale on a cybercrime forum, claiming it contains more than 75 million records tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic.
Revolut said it has found no evidence of unauthorized access or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around May 2025, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers reviewed samples from the advertised dataset and found records that reportedly extend to around May 2025, but they did not link the data to any previously documented Revolut incident. Initial analysis suggested the material may be aggregated from multiple sources rather than evidence of a single new breach.
Revolut stated that its internal monitoring and investigation found no evidence of unauthorized access or a new breach of its systems. The company also said the listing lacked verifiable record counts, meaningful samples, and technical proof of compromise.
A threat actor listed an alleged Revolut customer database for sale on a cybercrime forum or marketplace, claiming it contains more than 75 million user records. Reported sample data included personal information, account identifiers, device metadata, partial payment card details, and hashed credentials or password hashes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a large, publicly exposed database on an open cloud server containing **tens of millions of French citizen records** aggregated from at least five prior breaches, including voter data, healthcare entries, CRM contacts, financial profiles (including **IBANs/BICs**), and vehicle-related information. The dataset appears to have been compiled to increase resale value and enable identity cross-linking, elevating risks of **phishing, fraud, and identity theft**. Separately, Australia’s **Victorian Department of Education** notified parents that an unauthorized party accessed a student database containing names, school names, year levels, school-issued email addresses, and **encrypted passwords**, prompting a forced password reset and temporary account access disruption; the department stated more sensitive fields (e.g., home addresses, phone numbers) were not exposed and investigators had not confirmed public release. In another unrelated report, researchers questioned the veracity of a newly claimed **PayPal** breach, assessing a ~100,000-record credential “combolist” as likely **outdated infostealer-log data** rather than evidence of a fresh PayPal compromise, noting PayPal’s prior refutation of similar claims and the practical barriers posed by MFA.
Jun 29, 2026
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
A threat actor using the alias **"Jeffrey Epstein"** claimed to have stolen data on more than **400,000 Belgian customers** of Dutch online retailer **Bol** and advertised the dataset for sale on a dark web forum. Reports said the actor published a sample to support the claim and directed prospective buyers to negotiate through **Telegram** or **Session**. The allegedly exposed records include names, birthdates, phone numbers, email addresses, physical and shipping addresses, tracking numbers, order history, and some payment-related details, though reports said **passwords and bank or financial data were not included**. Bol said it was taking the claim seriously but had **no evidence of a hack or attack**, that its systems were operating normally, and that **no ransomware** was involved; if the data is genuine, it could be used in phishing, identity theft, and fraud targeting affected customers.
Jun 29, 2026