# Alleged Revolut Data Breach — Unverified Threat-Actor Claim of 75M-User Financial Dataset for Sale ($500, Sample Data Disputed as Fabricated)

> A threat actor listed a dataset on an underground cybercrime forum allegedly containing records for more than 75 million Revolut users, spanning payment-card metadata, hashed credentials, device fingerprints, and account/PII fields across five CSV files, priced at roughly $500. Revolut compared the published 100-record sample against production identifiers and found no matches, stating it is 'highly likely' the dataset is fabricated or recycled; the company's internal monitoring detected no unauthorized access as of 2026-07-29.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1819
- **ID:** TL-2026-1819
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-25, the X (Twitter) account @CyberWatch05 amplified a claim that Revolut — the UK-founded global neobank/fintech platform — had suffered a data breach exposing more than 75 million user records. OSINT/threat-intel accounts including @IBreaches ('Intel and Breaches') and 'Dark Web Intelligence' subsequently corroborated details of an underground-forum listing: the seller offered a dataset organized into five CSV files — cards.csv, credentials.csv, devices.csv, users.csv, and accounts.csv — allegedly containing partial payment-card data (scheme, status, creation/rotation metadata, last four digits, expiration), hashed credentials (bcrypt or argon2id), passcodes/MFA status and biometric indicators, device IDs/OS/registration IPs/activity timestamps, and names/emails/phone numbers/addresses/geolocation, priced at approximately $500 for the full set, with a 100-entry sample excerpt published to support the claim.

The claim has NOT been independently verified. Reporting on the story is internally inconsistent: GBHackers' own article headline cites '75 million users' while its body text references '757 million,' an order-of-magnitude discrepancy that was never reconciled in the source reporting. On 2026-07-28, Revolut Germany told heise.de that it had compared the user and card identifiers contained in the published sample against its production systems and found that 'none of them correspond to a valid or real Revolut identifier,' and in a same-day update stated the company had 'found no evidence of a security breach and believe it is highly likely that the dataset consists of fabricated data.' By 2026-07-29, Revolut's broader public position (relayed via Cybernews and other outlets) was that its internal monitoring and security controls had not detected unauthorized access, that no verifiable record count or meaningful data sample had been produced, and that the dataset — if genuine at all — is more likely an aggregation of previously leaked, purchased, or infostealer-sourced records than the product of a fresh large-scale intrusion. Independent researchers separately flagged two red flags consistent with a low-effort extortion/attention play rather than a genuine breach: (1) the anomalously low $500 asking price for a claimed 75M-record financial dataset, and (2) no record in the reviewed sample postdates approximately May 2025, suggesting stale or recycled source material rather than a live exfiltration.

This threat is tracked as an UNVERIFIED/likely-fabricated claim rather than a confirmed compromise. It nonetheless carries real downstream risk for defenders and Revolut customers independent of the claim's authenticity: (a) brand-impersonation and breach-themed phishing campaigns frequently follow high-profile breach claims regardless of veracity, (b) any genuinely leaked credential fragments (even if aggregated from older, unrelated leaks) can fuel credential-stuffing and account-takeover attempts against Revolut and other financial accounts where customers reuse passwords, and (c) the forum listing and its CSV structure (cards/credentials/devices/users/accounts) provide a template that other opportunistic actors may reuse to fabricate similar claims against other fintech brands. For historical context, Revolut previously confirmed a genuine, unrelated breach on 2022-09-11 caused by a targeted social-engineering attack against an employee, which exposed personal data (not passwords, PINs, or funds) for 50,150 customers (~0.16% of its then 20-million user base) — a materially smaller and differently-caused incident than the 2026 claim, illustrating why sample-data verification against production systems is the correct first response to breach claims of this kind.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1593 Search Open Websites/Domains
- T1597 Search Closed Sources
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Threat Actor Claims Revolut Data Breach Exposes Financial Records of 75 Million Users](https://gbhackers.com/threat-actor-claims-revolut-data-breach/)
- [Hackers claim they're selling 75M records of Revolut users' data](https://cybernews.com/security/revolut-data-breach-75-million-records/)
- [Revolut Data Breach Claim Allegedly Exposes Data of 75 Million Users](https://cyberpress.org/revolut-data-breach/)
- [Revolut Alleged Data Breach - Hackers Claiming to Access Over 75 Million Users' Records](https://cybersecuritynews.com/revolut-alleged-data-breach/)
- [Revolut Data Breach? Hackers Claim 75 Million User Records](https://www.esecurityplanet.com/threats/revolut-data-breach-hackers-claim-75-million-user-records/)
- [Revolut Data Breach Allegations: 75 Million Records at Risk](https://cypro.co.uk/insights/cyber-bulletins/revolut-data-breach-allegations-75-million-records-at-risk/)
- [Neobank Revolut: Allegedly 75 million data records offered on the dark web](https://www.heise.de/en/news/Neobank-Revolut-Allegedly-75-million-data-records-offered-on-the-dark-web-11379799.html)
- [Revolut Alleged Data Breach – Hackers Claiming to Access Over 75 Million Users' Records](https://www.cryptika.com/revolut-alleged-data-breach-hackers-claiming-to-access-over-75-million-users-records/)
- [Intel and Breaches (@IBreaches) — alleged Revolut cybercrime-forum listing thread](https://x.com/IBreaches/status/2081041628421345387)
- [Digital Bank Revolut Confirms Customer Data Breach (2022 incident, background)](https://www.bankinfosecurity.com/digital-bank-revolut-confirms-customer-data-breach-a-20117)
- [Over 50,000 Revolut Customers Affected by Data Breach (2022 incident, background)](https://www.securityweek.com/over-50000-revolut-customers-affected-data-breach/)
- [Revolut Faces $20 Million Loss as Attackers Exploit Payment System Weakness (2022/2023 incident, background)](https://thehackernews.com/2023/07/hackers-steal-20-million-by-exploiting.html)
- [75 million Revolut records allegedly for sale](https://oodaloop.com/briefs/cyber/75-million-revolut-records-allegedly-for-sale/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1819