Revolut data breach, September 2026: what is confirmed, what is not and what to ask

On 12 September 2026 Revolut announced that sensitive information about some of its customers had been handed over to an unauthorised party, following fraudulent requests sent from an email address on a government domain. In the following weeks, figures and reconstructions circulated, some of them put out by those who claim the attack. This article separates what is documented from what is only stated, claimed or not verified, and collects the questions that remain open. It contains no data on the people involved and no links to stolen material.

Essential timeline

• 12 September 2026: Revolut announces the incident. It is reported, among others, by The Paypers and PYMNTS, which cite Reuters and Bloomberg.
• 15 September: Sky TG24 reports on the cyber police investigation for unauthorised access to a computer system and computer fraud.
• 16 September: according to the Wall Street Journal, cited by PYMNTS, Revolut is the target of extortion threats from those who claim the attack.
• 18 September: the Garante per la protezione dei dati personali (the Italian data protection authority) publishes a note on the case.
• 7 October: according to Reuters, cited by PYMNTS, Revolut's head of Western Europe says the company will cover the costs of new identity documents for the customers involved.

VERIFIED: what the Garante says

The only primary document from an authority that we were able to read in full is the note from the Italian Garante dated 18 September 2026. In summary, it says:

• an immediate check has been launched on the security of access at Italian banks, to understand whether there have been other attempts like the one suffered by Revolut;
• the Garante's offices wrote to the network of the banks' data protection officers (DPOs), asking them to check their own systems to rule out «anomalous» communications coming from the same PEC mailbox, and to contact the Authority immediately if similar cases emerge, informing it pursuant to Article 33 of the GDPR;
• the Garante informed the Lithuanian authority, where Revolut has its main registered office, and asked it to confirm whether it has received a breach notification from Revolut in Lithuania and to share any useful information, also to understand whether other banks active in Italy are involved;
• the Authority has also moved together with the Ministry of the Interior, to understand whether other banks or institutions are involved and which data were compromised;
• the affair, the Garante writes, has highlighted «some weak points of the official PECs in use».

Two clarifications. The Garante does not say which PEC mailbox was used, or by which body. And the note comes from the Italian Garante: the Lithuanian authority, which has primary competence over the company, has not, as far as we could find, published a statement on this episode.

STATED BY REVOLUT

The company's position, as reported by Sky TG24, PYMNTS and The Paypers:

• the company announced the incident on 12 September 2026 (date reported by The Paypers and PYMNTS, which cite Reuters and Bloomberg);
• it was a «sophisticated external impersonation scam», in which an unauthorised party used the email address of a legitimate domain of a government agency to submit fraudulent requests for information;
• as soon as the fraud was identified, the address was blocked and the agency concerned, law enforcement, data protection authorities and financial supervisory authorities were informed;
• Revolut's systems and customer funds were not touched;
• the people involved were contacted directly;
• requests coming from verified government domains are treated as mandatory legal requests; in this case, as they contained valid technical authentication of the domain, they were fulfilled «with the reasonable expectation that it was a genuine investigation»;
• according to the email sent to customers, cited by PYMNTS which in turn cites TechCrunch, the exposed data include identity and contact details (date of birth, addresses, telephone), documents such as passports and driving licences, and possibly verification selfies, account statements and transaction history.

The number. The figure mentioned is about 680 customers. The sources do not agree on who provided it: Sky TG24 attributes it to the company, while The Paypers and SecurityWeek write that Revolut has not disclosed the number. On 7 October, according to Reuters cited by PYMNTS, the head of Western Europe spoke of assistance for the 680 customers involved. On the other hand, the number of Italian customers is not known from official sources.

CLAIMED by those who say they carried out the attack

Everything that follows comes from parties who have an interest in exaggerating or creating a stir. We report it because it is part of the story, not because it is proven.

• A party calling itself «IAmNotAVillain» told the Financial Times, according to Sky TG24, that it first contacted Revolut a couple of months earlier by posing as an Italian police authority, and that the company would have responded to the requests «like a good boy».
• According to SecurityWeek, the same party publicly demanded 3 million dollars, threatening to sell the data. Revolut told SecurityWeek that it had not received «any direct contact or request» from the people making these claims. Other outlets report different figures for the demand; we do not consider them verified.
• Also according to SecurityWeek, in separate communications the authors stated that the campaign lasted five or six months and included the theft of more than 147 GB of data from an Italian police agency.
• According to the Wall Street Journal, cited by PYMNTS, the author allegedly released parts of customer data while threatening to release more. Revolut, when contacted by the newspaper, said it had alerted law enforcement and did not comment further.

One point must be kept separate from the rest: the idea that Revolut fulfilled the requests «for months» and «without checking» is, at present, a claim by those who say they carried out the attack. Revolut maintains that it applied the procedure laid down for legal requests. No independent source that we have read documents for how long or with what checks the requests were handled.

NOT VERIFIED

• The PEC mailbox and the body. SecurityWeek writes that the compromised address on pec.interno.it «appears to belong» to an employee of the Ministry of the Interior and reports the analysis by the security company Hudson Rock, which speaks of more than 300 credentials associated with that domain and a probable origin in previously stolen credentials. This is a hypothesis by a private company, not a finding. BusinessOnline notes that no independent source has confirmed the compromise of that specific mailbox and that the details come from documents released by the authors themselves. Some media have named a specific body: this is not confirmed and we do not report it.
• The investigations. Sky TG24 reports on the cyber police investigation. According to BusinessOnline, an inquiry by the British data protection authority (ICO) has also been open since 15 September; we have not found an ICO document confirming it.
• The crypto side. Some outlets speak of bitcoin movements among the exposed data. The email to customers, as reported, speaks generically of account statements and transaction history; we have no primary source on the detail.
• The final number of people involved and the possible involvement of other banks or institutions.

The open questions

What follows is not an accusation: these are the questions that, on the basis of the available documents, nobody has yet answered publicly.

1. What checks does Revolut apply to data requests that come from authorities, beyond the technical authentication of the mail domain? Is there an independent verification, for example a call-back to an already known contact?
2. How many requests were fulfilled, over what period of time, and how were they recorded and reviewed before the discovery?
3. What did the Lithuanian authority receive, and when? Was the breach notification required by Article 33 of the GDPR sent within 72 hours of discovery?
4. How many Italian customers are involved and were they informed individually?
5. Which PEC mailbox was used, since when was it compromised and who is responsible for it? The Garante speaks of «weak points» in the official PECs: which ones, and with what remedial action?
6. Why was the number of customers involved communicated only afterwards, and by whom?
7. Do the announced measures (the cost of new identity documents) apply to everyone involved, in all countries, and what other protections are provided?

If you use a digital account or hold crypto: cautious guidance

This is general guidance, not advice. There is nothing in the sources we have read to say that customer funds are at risk: the company states that funds and systems were not touched. The documented risk concerns personal data.

• Check communications only from the official app. After a case like this, fake emails and messages offering «assistance», «data recovery» or «identity verification» increase. Do not click links you receive and do not give codes or recovery phrases to anyone.
• If you have received a notification that you are involved, keep the message, consider calmly whether to replace your identity document (the company has stated that it will cover the costs for the customers involved, according to Reuters) and periodically check transactions and positions in your name.
• Do not reply to or pay anyone who says they have your data. Keep the evidence and report it to the local police or cybercrime authority. Do not look for or spread stolen material.
• Authentication. Prefer authentication apps or physical keys over SMS and use an email address dedicated to financial services.
• Privacy. Anyone who knows that you hold crypto can become a target of targeted scams. Avoid making balances and transactions public and consider carefully where you keep your keys.
• Do not decide in a panic. If you are thinking of switching service, do so calmly, first checking that the new operator is authorised (for crypto service providers see our guide to checking the MiCA register) and without moving funds hastily to unknown platforms.

Frequently asked questions