Cyber security

Revolut customer data breach: $3 million ransom demanded

The British fintech company has alerted the users concerned. The fraudulent request, which appeared to come from a government body, may have originated in our country

by Vittoria Belluschi

15 September 2026aggiornato il 16 settembre alle ore 22,33

Aggiungi Il Sole 24 Ore
ai preferiti su Google

4' min read

4' min read

Imagine receiving an email from your bank informing you that your personal details, contact addresses, identification documents and financial details (including transaction history) are now in the hands of a group of hackers who, according to the Financial Times, are demanding that the bank pay a ransom of $3 million within 24 hours; otherwise, they are threatening to sell the data to other criminal groups.

This is what happened to several customers Revolut customers – an estimated total of just under 700 people. The British fintech company has notified the affected users by email: “We are contacting you to inform you of a recent security incident, involving an external identity theft that has resulted in some of your personal data being shared with an unauthorised third party.”

What happened

Revolut stated that it had received a request to share its customers’ data from an account that appeared to belong to a government body. The company proceeded to provide the requested information, in accordance with the GDPR (General Data Protection Regulation). Under the European regulation, a company is required to disclose its customers’ personal data if the request from the government body is binding, formally legitimate and based on specific legal provisions (such as investigation orders or warrants).

“The procedure for a government agency to request data is called an ‘emergency data request’, and all platforms (social networks, cloud providers) handle dozens of them every day,” explains Marco Ramilli, founder of the Italian cyber intelligence firm Yoroi.

The problem? The person who made the request was not actually a public authority. The hackers were posing as someone else, using an email address that actually belonged to a government body’s email domain and therefore had valid authentication credentials.

“As soon as we identified the potential risk factors, we alerted the relevant authority,” Revolut explains. Law enforcement agencies, data protection authorities and financial regulators were then contacted.

The notice also states that the accounts of users affected by the incident remain secure and that the company has ‘immediately’ blocked the fraudulent address.

The Italian track

Once the case became public knowledge, a storm broke out on the social media platform X. According to documents obtained and shared by ‘I Am Not A Villain’, the Telegram channel apparently run by the hackers behind the scam, the email address the cybercriminals appear to have gained access to belongs to the Reggio Calabria Prefecture: entilocali.prefrc@pec.interno.it. It also states a date of dispatch: 24 July 2026. The emails would therefore appear to have originated from an Italian institution, although this has not been confirmed. The Prefecture of Reggio Calabria is said to have requested ‘banking and financial information’ regarding accounts held with Revolut Bank UAB, a Latvian company, for the purposes of a European investigation.

Meanwhile, the ‘International Cyber Digest’, an independent organisation reporting on cyber security news, has stated that hackers are sharing the sensitive data they have stolen, including photos. “They want Revolut to pay. They say they will release more messages, data and information about how the Revolut group operates,” the report states.

Not only that: the group ‘I Am Not A Villain’ claims to have obtained ‘over 87,000 files, totalling 147 GB of documents, emails and personal files’ belonging to the Italian law enforcement agencies.

Among the customers affected by the scam are reportedly well-known figures such as Mark Karpelès, former chief executive of the cryptocurrency exchange Mt. Gox, and the entrepreneur Felix Romer. Romer has reported receiving blackmail threats based on data stolen from Revolut, as early as two months before the company contacted users to inform them of the scam. It would appear, in fact, that the hackers had been at work for several months – perhaps as many as six.

In the last few hours, Revolut has stated that no one – neither individuals nor groups – has made direct contact or put forward any demands. The company therefore appears to be denying the hackers’ ultimatum.

The intervention by the police

According to reports, the Postal Police are investigating unauthorised access to a computer system and cyber fraud, and the National Anti-Mafia and Anti-Terrorism Directorate (DNA) has also been called in. DNA magistrates intervene when the breach involves a government body. The Postal Police’s initial report describes a highly sophisticated operation. Investigators are trying to establish whether the Prefecture’s certified email account was ‘hacked’ or cloned.

The expert has his say

But how was it possible to gain access to an institutional email system? “The email account may have been compromised: there are numerous methods, known as ‘attack paths’, for achieving this result – account takeover,” explains Marco Ramilli. An account takeover is a form of identity theft in which a malicious user gains unauthorised access to another person’s online account.

The government body that was compromised may not have realised this because a PEC is a ‘type of email typically used for official communications or legal matters and, for this reason, may not be monitored as regularly and consistently as a personal email account’.