The threat actors behind the Revolut data incident have reportedly begun publicly leaking customer information and demanding payment from Revolut, threatening to release additional victims every day until the company pays.
The leaks reportedly include passports and KYC selfies belonging to named individuals, including tennis player Alexander Shevchenko and Gamdom CEO Felix Römer.
The attackers claim their operation ran for six months and that most of the Revolut data obtained comes from Switzerland and France, with customer records from roughly 30 additional countries also compromised.
The attack reportedly did not involve a direct breach of Revolut’s systems.
Attackers explain on their own website seen below how they used a real government agency email domain, with reporting pointing to compromised Italian PEC infrastructure, to send fraudulent law enforcement data requests to Revolut.
The emails passed DKIM authentication checks and were treated as legitimate by Revolut’s compliance team, which then handed over customer information.
The exposed records allegedly include passports, KYC selfies, names, addresses, phone numbers, emails, bank account identifiers, fiat transaction histories, and Bitcoin and other crypto deposits and withdrawals.
According to @intcyberdigest, the attackers also claim to have compromised multiple Italian law enforcement departments and stolen 147 GB of internal documents, calendars, communications and personal material.
The attackers are now attempting to extort Revolut using the customer data obtained through those fraudulent government requests.
The full scale of the breach remains unclear.
