Loading story…
Revolut disclosed that it released customer information to a third party responding to fraudulent requests sent through a spoofed government email domain. Attackers allegedly used infostealer-compromised Italian Ministry of the Interior email accounts to monitor communications for months and issue fake European Investigation Orders seeking KYC records from Revolut’s Lithuanian-regulated entity. The actor calling itself “IAmNotAVillain” claims to possess personal, identity-verification, and financial data and has reportedly demanded a $3 million ransom, although Revolut said it received no direct demand and that customer funds and its core systems were unaffected.
The stolen data has reportedly enabled a targeted SMS-phishing campaign against Revolut customers, including high-net-worth cryptocurrency users selected through blockchain-record analysis. Some smishing messages appeared within legitimate Revolut SMS threads and linked victims to counterfeit pages that mimicked the bank’s live-video identity-verification process before requesting account passwords. Revolut said it blocked the fraudulent address and notified authorities and regulators; customers should treat unsolicited identity-verification or password requests as phishing and verify communications through official Revolut channels.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
A reported fraudulent Revolut SMS was received on September 14, directing the recipient to confirm their identity or face account restrictions. The linked phishing page imitated Revolut's live-video identity verification process, requested camera access, and then sought the victim's password.
Revolut acknowledged a security incident involving customer information disclosed in response to fraudulent requests impersonating a government agency.
Italian police reportedly began investigating the fraudulent government-email activity and related Revolut customer-data exposure.
A threat actor using the alias “IAmNotAVillain” claimed responsibility, listed Revolut on a dark-web site, and threatened to sell the alleged stolen database unless paid a $3 million ransom. Revolut said it had received no direct ransom demand from the claimant.
After identifying the scam, Revolut said it blocked the fraudulent email address and notified relevant authorities and regulators. The company said its systems and customer funds were unaffected.
Using compromised or spoofed government email accounts, attackers impersonated law enforcement and submitted fraudulent European Investigation Orders to Lithuania-based Revolut Bank UAB. Revolut reportedly processed repeated requests, exposing data from a small number to several hundred customer accounts.
Attackers allegedly used credentials from infostealer logs to access Italian Ministry of the Interior or other government employee email accounts, monitored communications, and added attacker-controlled recovery addresses. They reportedly retained access for roughly five to six months.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourceinfosecurity-magazine.com
Open sourceinfostealers.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Revolut disclosed that it released sensitive customer information to an unauthorized party after receiving a fraudulent data request impersonating a legitimate government agency. The request reportedly originated from an unauthorized account using an official agency email domain with valid domain-authentication credentials, causing it to be treated as legitimate. The number of affected customers, the impersonated authority, and the precise failure path have not been publicly confirmed. The exposed records reportedly include passport or other KYC identity documents, facial-verification selfies, contact details, account statements, IBANs, withdrawal records, and full transaction histories, including Bitcoin-related activity. Revolut said its core systems, mobile app, customer accounts, and funds were not compromised; it blocked the email source, notified authorities, and contacted affected users. The combined identity and financial data creates elevated risks of identity fraud, targeted phishing and vishing, SIM-swapping, fraudulent account opening or direct debits, extortion, and persistent linkage between customer identities and blockchain addresses.
Sep 18, 2026
A threat actor has advertised an alleged **Revolut** customer database for sale on a cybercrime forum, claiming it contains more than **75 million records** tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic. Revolut said it has found **no evidence of unauthorized access** or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around **May 2025**, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Jul 30, 2026
A wave of threatening email campaigns is using intimidation and recycled data to pressure recipients into paying attackers. One campaign sent sextortion emails demanding **$2,000 in Bitcoin**, falsely claiming the sender had hacked victims’ devices, activated cameras and microphones, and recorded visits to adult websites. Reporting indicates the messages relied on email addresses exposed in earlier **ShinyHunters-linked** data leaks, with criminals referencing companies associated with the recipient’s address to make the threats appear credible. Betterment said some customers received the emails and emphasized that possession of an email address alone does not give an attacker access to a device. A separate warning from **CERT Bulgaria** described a campaign of threatening emails about allegedly planted explosive devices, underscoring a broader pattern of coercive messaging designed to trigger fear rather than reflecting confirmed compromise. Together, the incidents show how threat actors are repurposing previously leaked personal data and high-pressure hoax narratives to drive extortion and social engineering, while security authorities and affected organizations stress that recipients should treat the claims as fraudulent unless independent evidence shows an actual intrusion.
Aug 10, 2026