New reporting has filled in the timeline and scope of the Revolut breach first disclosed on September 14, 2026: the fraudulent data requests ran for roughly five months, hit about 680 high-value "crypto whale" accounts, and pulled in 147GB of data from an Italian law enforcement system in the process. A threat actor is now publicly demanding $3 million for the stolen customer data.
How the Breach Happened
Revolut's own account of the incident said it complied with a data request that appeared to come from a legitimate government agency using an authenticated domain. The fuller picture: the attackers had compromised an employee's email account at Italy's Ministry of the Interior through infostealer malware, giving them working credentials on the ministry's pec.interno.it domain. From there, they sent a stream of fraudulent legal data requests to Revolut Bank UAB, the company's Lithuania-based subsidiary — and Revolut fulfilled them without independently verifying legitimacy, for months.
Threat intelligence firm Hudson Rock, which analyzed the credential compromise, said the attackers likely didn't infect the ministry employees themselves: "it is highly unlikely the hacker actively infected these specific employees themselves. Instead, they likely purchased or utilized existing Infostealer logs." That distinction matters — it means the initial access came from the broader, already-circulating infostealer-log economy rather than a bespoke intrusion, and that anyone whose credentials sit in an old stealer log is a potential entry point for this kind of impersonation attack.
Who Was Affected
Around 680 Revolut customers — described as cryptocurrency "whales" — had passports, email addresses, phone numbers, and financial data exposed. Separately, more than 147GB of data was stolen directly from the compromised Italian law enforcement system, a scope well beyond the customer-facing breach alone.
The Ransom Demand
A threat actor using the handle "IAmNotAVillain" has publicly demanded $3 million, threatening to sell the customer data if unpaid. Revolut disputes even that much contact occurred, stating: "Revolut has not received any direct contact or demand from the individuals or group making these claims." The company has also declined to name the impersonated agency or confirm exact victim numbers.
Why It Matters
This is Revolut's second disclosed breach in recent years (the company reported a 2022 incident affecting over 50,000 customers), and the pattern here extends a trend the original disclosure already flagged: attackers don't need a technical exploit against Revolut's systems when a spoofed-but-authenticated government request will do the job. The five-month duration is the most important new data point — it means the same social-engineering vector worked repeatedly against the same institution for months before detection, not once. For any organization that fields legal or regulatory data requests, this is a reminder that domain authentication alone (SPF/DKIM passing) is not proof of legitimacy, and that verifying requests through an independently confirmed channel — not the contact information in the request itself — is the control that would have stopped this.