Revolut Hit by $780 Million Bitcoin Ransom Demand After Customer Data Was Exposed in Government-Email Scam

Revolut confirmed on September 12, 2026 that it disclosed sensitive customer information after attackers impersonated a government agency, and the group behind the incident is now demanding 10,000 Bitcoin, or roughly $780 million, while posting samples of the data on Telegram. For PSPs and high-risk merchants, the useful bit is not the headline number but the mechanism: a fraudulent legal request got treated like a real one, which means the control failure sits in the intake process, not in the core banking stack.

1. Revolut, the UK-based financial technology company that offers banking, card and cryptocurrency services to more than 80 million customers worldwide, said an unauthorized party used an email account on a real government agency’s domain to submit a fraudulent request for customer records. Revolut treated the request as genuine and handed over data before discovering it had been deceived.
2. The company said its core banking systems, databases and customer funds were not breached, and described the incident as a “sophisticated external impersonation scam.” Revolut said only a “very limited” number of customers were affected, but did not give an exact figure.
3. The exposed information reportedly included names, dates of birth, home and email addresses, phone numbers, copies of passports and driver’s licenses, verification selfies, account statements and full transaction histories, including records of Bitcoin activity. For a payments business, that is the kind of dataset that can be used for identity fraud, account takeover attempts and targeted social engineering, not just embarrassment.
4. A hacking group calling itself “Revolut Smilik” told City AM that it is seeking payment from Revolut. According to multiple reports, the group has demanded 10,000 Bitcoin and has begun publishing customer files on Telegram, warning that it will release “more and more data every day” until it is paid.
5. People whose information has reportedly already been posted include Mark Karpelès, the former head of the collapsed cryptocurrency exchange Mt. Gox, along with a professional tennis player and the founder of a crypto gambling platform. Revolut has declined to confirm or comment on the ransom demand.

The UK’s Information Commissioner’s Office said it has received a report and is assessing it. Financial institutions are generally required by law to comply with genuine requests from law enforcement or government agencies, which is why this sort of impersonation can work on paper and then turn into a very expensive problem in practice.