Threat reportData BreachTL-2026-1819

Alleged Revolut Data Breach — Unverified Threat-Actor Claim of 75M-User Financial Dataset for Sale ($500, Sample Data Disputed as Fabricated)

mediumTRACKING

Alleged Revolut Data Breach (TL-2026-1819), also tracked as Revolut 75M Records Breach Claim, is a medium-severity data breach, first published 2026-08-02. It has no confirmed attribution, affects Revolut Ltd Revolut consumer fintech/banking platform (customer, maps to 15 MITRE ATT&CK techniques (T1078, T1110, T1119), and is covered by 9 detection rules and 20 indicators of compromise.

Severity
MEDIUMAssessed severity
CVEs
0None referenced
Techniques
15MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
20Indicators of compromise

Key facts for TL-2026-1819

Threat ID
TL-2026-1819
Also known as
Revolut 75M Records Breach Claim, Revolut CSV Dataset Listing (cards/credentials/devices/users/accounts)
Severity
MEDIUM
Status
TRACKING
Category
DATA_BREACH
First published
Last reviewed
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
financial services, fintech, banking, payments
Target regions
Europe, united kingdom, Global
Detection rules
9
Indicators of compromise
20

How Alleged Revolut Data Breach works

A threat actor listed a dataset on an underground cybercrime forum allegedly containing records for more than 75 million Revolut users, spanning payment-card metadata, hashed credentials, device fingerprints, and account/PII fields across five CSV files, priced at roughly $500. Revolut compared the published 100-record sample against production identifiers and found no matches, stating it is 'highly likely' the dataset is fabricated or recycled; the company's internal monitoring detected no unauthorized access as of 2026-07-29.

On 2026-07-25, the X (Twitter) account @CyberWatch05 amplified a claim that Revolut — the UK-founded global neobank/fintech platform — had suffered a data breach exposing more than 75 million user records. OSINT/threat-intel accounts including @IBreaches ('Intel and Breaches') and 'Dark Web Intelligence' subsequently corroborated details of an underground-forum listing: the seller offered a dataset organized into five CSV files — cards.csv, credentials.csv, devices.csv, users.csv, and accounts.csv — allegedly containing partial payment-card data (scheme, status, creation/rotation metadata, last four digits, expiration), hashed credentials (bcrypt or argon2id), passcodes/MFA status and biometric indicators, device IDs/OS/registration IPs/activity timestamps, and names/emails/phone numbers/addresses/geolocation, priced at approximately $500 for the full set, with a 100-entry sample excerpt published to support the claim.

The claim has NOT been independently verified. Reporting on the story is internally inconsistent: GBHackers' own article headline cites '75 million users' while its body text references '757 million,' an order-of-magnitude discrepancy that was never reconciled in the source reporting. On 2026-07-28, Revolut Germany told heise.de that it had compared the user and card identifiers contained in the published sample against its production systems and found that 'none of them correspond to a valid or real Revolut identifier,' and in a same-day update stated the company had 'found no evidence of a security breach and believe it is highly likely that the dataset consists of fabricated data.' By 2026-07-29, Revolut's broader public position (relayed via Cybernews and other outlets) was that its internal monitoring and security controls had not detected unauthorized access, that no verifiable record count or meaningful data sample had been produced, and that the dataset — if genuine at all — is more likely an aggregation of previously leaked, purchased, or infostealer-sourced records than the product of a fresh large-scale intrusion. Independent researchers separately flagged two red flags consistent with a low-effort extortion/attention play rather than a genuine breach: (1) the anomalously low $500 asking price for a claimed 75M-record financial dataset, and (2) no record in the reviewed sample postdates approximately May 2025, suggesting stale or recycled source material rather than a live exfiltration.

This threat is tracked as an UNVERIFIED/likely-fabricated claim rather than a confirmed compromise. It nonetheless carries real downstream risk for defenders and Revolut customers independent of the claim's authenticity: (a) brand-impersonation and breach-themed phishing campaigns frequently follow high-profile breach claims regardless of veracity, (b) any genuinely leaked credential fragments (even if aggregated from older, unrelated leaks) can fuel credential-stuffing and account-takeover attempts against Revolut and other financial accounts where customers reuse passwords, and (c) the forum listing and its CSV structure (cards/credentials/devices/users/accounts) provide a template that other opportunistic actors may reuse to fabricate similar claims against other fintech brands. For historical context, Revolut previously confirmed a genuine, unrelated breach on 2022-09-11 caused by a targeted social-engineering attack against an employee, which exposed personal data (not passwords, PINs, or funds) for 50,150 customers (~0.16% of its then 20-million user base) — a materially smaller and differently-caused incident than the 2026 claim, illustrating why sample-data verification against production systems is the correct first response to breach claims of this kind.

MITRE ATT&CK techniques used in TL-2026-1819

Initial Access

T1078 Valid Accounts; T1566 Phishing

Credential Access

T1110 Brute Force; T1552 Unsecured Credentials

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1593 Search Open Websites/Domains; T1597 Search Closed Sources

Impact

T1657 Financial Theft

Affected products and versions in Alleged Revolut Data Breach

  • Revolut Ltd — Revolut consumer fintech/banking platform (customer account database, allegedly)
    Vulnerable versions: N/A — data-breach claim, not a software version-specific vulnerability
    Fixed in: N/A — Revolut reports no evidence of unauthorized access; no patch applicable

Remediation for Alleged Revolut Data Breach

Patches

  • Not applicable — no software vulnerability, CVE, or exploitable flaw has been identified or claimed; this is a data-exposure allegation, not a vulnerability report

Immediate actions

  • Revolut customers should verify multi-factor authentication is enabled and review the app's list of trusted/registered devices for anything unrecognized
  • Treat unsolicited SMS, email, or push notifications referencing 'the Revolut breach' as likely phishing lures and verify account status only via the official Revolut app or revolut.com, never via links in unsolicited messages
  • Rotate the Revolut account password and any reused password shared with other financial or email accounts as a precaution, independent of whether the dataset is authentic
  • Security teams monitoring the brand should compare any published sample records against known-valid internal identifiers before escalating, following the same triage Revolut performed

Workarounds

  • None required in the absence of confirmed compromise; as of 2026-07-29 Revolut's internal monitoring and security controls reported no detection of unauthorized system access related to the alleged dataset

Longer-term hardening

  • Deploy phishing-resistant MFA (FIDO2/passkeys) for financial-platform and email accounts to blunt any credential-stuffing attempts that leverage genuinely-leaked fragments aggregated into claims like this one
  • Maintain continuous monitoring of underground/cybercrime forums and OSINT breach-tracking accounts (e.g., the @CyberWatch05 / @IBreaches / 'Dark Web Intelligence' ecosystem) for brand mentions to catch both genuine leaks and reputation-damaging fabricated claims early
  • Establish a documented breach-claim triage runbook (sample validation against production identifiers, record-freshness analysis, price/scale plausibility check) to rapidly produce an evidence-based public statement, as Revolut did within days
  • Run periodic customer education campaigns on recognizing breach-themed phishing and social-engineering lures, given Revolut's prior 2022 breach originated from social engineering rather than a technical exploit

Timeline of Alleged Revolut Data Breach

  • Revolut confirms a genuine, unrelated data breach caused by a targeted social-engineering attack on an employee, exposing personal data (names, addresses, emails, phone numbers, partial card data — not passwords, PINs, or funds) for 50,150 customers (~0.16% of its then 20-million user base). Cited here as historical baseline distinguishing a confirmed prior incident from the 2026 unverified claim.
  • Researchers reviewing the alleged 2026 dataset's sample records found no entries newer than approximately May 2025, an indicator of stale or recycled source material rather than a freshly exfiltrated dataset.
  • OSINT/threat-intel accounts @IBreaches ('Intel and Breaches') and 'Dark Web Intelligence' corroborate and expand on the forum listing, detailing the five-CSV structure (cards.csv, credentials.csv, devices.csv, users.csv, accounts.csv) and noting a published 100-entry sample excerpt.
  • The X (Twitter) account @CyberWatch05 posts a screenshot amplifying a claim that a threat actor is offering a dataset tied to more than 75 million Revolut users on an underground cybercrime forum, priced at approximately $500.
  • OODAloop publishes a brief citing a fuller Cybernews investigation, reporting that the threat actor's sample evidence consisted of 4 .csv files (fewer than the 5-file cards/credentials/devices/users/accounts structure described by other OSINT reporting) and that researchers flagged the sample data as potentially tied to Revolut's customer referral/rewards program rather than core account records; the brief advises Revolut customers to watch for follow-on phishing.
  • At 22:50 CEST the same day, Revolut Germany issues an updated, conclusive statement to heise.de: 'Our investigation is complete. We have found no evidence of a security breach and believe it is highly likely that the dataset consists of fabricated data.'
  • Revolut Germany issues an initial statement to heise.de: 'We have compared the user and card identifiers contained in the sample data of the original post with our systems. None of them correspond to a valid or real Revolut identifier.' At this point the company characterizes its verification as ongoing.
  • Source-review identifies an unreconciled internal inconsistency in GBHackers' own article — the headline cites '75 million' affected users while the body text separately references '757 million' — underscoring the low reliability of the claim's reporting chain.
  • GBHackers, Cybernews, CyberPress, Cybersecuritynews.com, eSecurityPlanet, cypro.co.uk, and Cryptika publish coverage of the claim; Revolut states its internal monitoring and security controls have detected no unauthorized access, that it continues to investigate the claims, and that the data, if real at all, is likely an aggregation of prior leaks or third-party sources rather than a fresh intrusion.
  • Secondary reporting (cypro.co.uk and the Cybernews investigation referenced by OODAloop) dates the underground-forum listing itself to 2026-07-29 — four days after the 2026-07-25 X amplification that first publicized it — an unreconciled discrepancy in the claim's reporting timeline, separate from the 75M/757M figure inconsistency.

Sources cited for Alleged Revolut Data Breach

Detection coverage for TL-2026-1819

As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1819 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
20 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats