Revolut customer data leak exposes passports, crypto transactions; 10,000 BTC ransom demanded

Attackers impersonated a government agency using a spoofed legitimate government domain email to bypass Revolut's security checks and request customer information, according to Protos. Upon detection, Revolut immediately blocked the address and alerted relevant government and enforcement agencies, data protection, and financial regulators, per the company's statement to Protos. Information potentially disclosed included names, dates of birth, addresses, email addresses and phone numbers, alongside copies of passports and driving licenses. Customer notifications also reportedly referenced account statements, IBANs, withdrawal records and transaction histories, including Bitcoin activity, per Protos. According to posts on X, the attackers are demanding 10,000 BTC in exchange for not releasing additional customer data. Protos reported that people claiming they hold the pack are posting ID copies and selfies on Telegram and saying they will drip more data daily. Revolut stated that the number of affected customers was "very limited," but declined to disclose a precise figure. Revolut has not confirmed the ransom demand or authenticated any of the material currently circulating online. Revolut also stated that its systems and customer funds are unaffected. Former Mt. Gox CEO Mark Karpelès revealed that he was among those affected, with account statements, IBANs, withdrawal records and full transaction histories, including BTC transactions, potentially exposed, according to Protos. On-chain investigator ZachXBT suggested that the attackers may have specifically targeted wealthy Revolut customers and that the attack appeared to involve a relatively small number of high-net-worth users. Crypto analyst Max Karpis pointed out that such a $780 million Bitcoin payment would be easily traced, making it extremely difficult for the attackers to cash out, per Protos. The Daily Hodl reported that threat actors say they initially contacted the company with information demands before beginning to share details including those of prominent clients, and that the group accuses Revolut of negligence around privacy protections and of sharing sensitive information with countries outside its jurisdiction.