Revolut Data Breach: Hackers Demand $3 Million Ransom After Phishing Attack 2026

Revolut, the digital banking app, has confirmed a sophisticated data breach that exposed the personal information of some of its customers. The incident, which occurred on September 12, was not the result of a system hack but rather a clever phishing attack that tricked Revolut into responding to a fraudulent email. Now, according to the Financial Times, the hackers behind the attack are demanding a $3 million ransom.

What Happened in the Revolut Data Breach?

Revolut released an official statement confirming that an unauthorized third party used the legitimate email domain of a government agency to fraudulently request information. The company described it as a "sophisticated case of impersonation." While Revolut has not disclosed which agency was impersonated or the country of origin, it is believed to be Italy.

Upon detecting the incident, Revolut blocked the email address and notified the impersonated agency, law enforcement, data protection authorities, and financial regulators. The breach exposed customer data, though the exact number of affected individuals has not been revealed.

Why This Attack Was So Effective

The scammers didn't just spoof the logo or use a similar-looking email address; they sent the email from a legitimate domain. This made the request appear authentic, leading Revolut to respond as if it were a genuine inquiry. This level of sophistication highlights the growing threat of social engineering attacks, where attackers exploit trust in legitimate institutions.

Such attacks are particularly dangerous because they bypass traditional security measures that focus on technical vulnerabilities. Instead, they target human error and procedural weaknesses.

The Ransom Demand: What We Know

On September 18, the Financial Times reported that the hackers are demanding a $3 million ransom from Revolut. This development suggests that the attackers may have exfiltrated more data than initially thought or are attempting to monetize the breach further. Revolut has not publicly commented on the ransom demand.

Ransom demands in data breaches are increasingly common, with cybercriminals threatening to release sensitive information if their demands are not met. Companies often face a difficult decision: pay the ransom and hope the data is destroyed, or refuse and risk public exposure.

Who Is Affected and What Are the Risks?

Revolut has not specified how many customers are affected or what types of data were exposed. However, given the nature of the phishing attack, it is likely that personal details such as names, addresses, and possibly financial information were compromised.

Affected customers could be at risk of identity theft, phishing attempts, and financial fraud. Revolut has advised customers to be vigilant and monitor their accounts for suspicious activity.

What Revolut Is Doing to Respond

Revolut has taken steps to contain the breach, including blocking the fraudulent email address and notifying relevant authorities. The company is also cooperating with law enforcement and regulators.

In addition, Revolut may be required to inform affected customers directly, depending on data protection regulations such as GDPR. The company has not yet released details about customer notifications.

Key Takeaways for Consumers

• Always verify the sender's email address before responding to requests for information.
• Be cautious of emails that appear to come from government agencies, even if they look legitimate.
• Monitor your financial accounts regularly for unusual activity.
• Enable two-factor authentication wherever possible to add an extra layer of security.
• Stay informed about data breaches that may affect you and follow advice from your bank.

How This Breach Compares to Other Fintech Incidents

This table shows that phishing and social engineering are common attack vectors in the fintech industry, often leading to significant data exposure. The background to this story is set out in RNLI Data Breach: Supporters Warned After Cyber Attack. A related thread runs through UK Data Breach: Hackers Steal 740K Records from DfE and Police. Earlier coverage in UK Investment Agency Data Breach Exposes 51 Officials shows how the argument developed.

What to Watch Next

The situation is still developing. Revolut may face regulatory scrutiny over how it handled the breach, especially if it is found to have been negligent. The ransom demand adds another layer of complexity, as the company must decide whether to negotiate with attackers. A closer look at the same subject appears in Dyfed-Powys Police Cyber-Attack: Staff Data Security Breach. Anyone following the wider picture can start with Origin Energy Data Breach: 900,000 Customers Affected. The same theme surfaces in Revolut Outage: App Down in Multiple Countries, Users Locked, which takes a different angle.

Customers should watch for official communication from Revolut and take proactive steps to protect their personal information. Context on how this played out before sits in Asos Hack Notification Sparks Data Breach Investigation. A companion piece, Asos Data Breach: Hacker Accessed Customer Data via Trusted Contact, approaches the same subject from another angle.