# Revolut Discloses Data Breach via Government-Impersonation Social Engineering, Exposing Customer Financial and Passport Data

> Revolut disclosed a data breach in which an unauthorized third party used a legitimate, domain-authenticated government agency email account to submit fraudulent requests for customer information, which Revolut staff fulfilled as a routine legal-compliance request. Exposed data for a limited number of customers — reportedly skewed toward high-net-worth individuals — includes passports/driver's licenses, KYC verification selfies, IBANs, account statements, and full transaction histories including Bitcoin activity; the threat actor has since begun publicly leaking samples on X and Telegram while demanding roughly 10,000 BTC (~$782M) not to release more.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2498
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-revolut-fake-government-request-tl-2026-2498.webp?v=d6f6d1cf (Threadlinqs threat intel: Revolut Fake Government Request Breach: Detection & IOCs (TL-2026-2498) — High severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-2498
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13

## Description

On September 12, 2026, UK-based neobank Revolut confirmed a data breach stemming not from a technical intrusion but from abuse of its legal/regulatory information-request process. Revolut stated: "Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency's email domain," and that because "the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request." Revolut has declined to name the government agency involved, the country/market affected, or the number of impacted customers, describing it only as a "sophisticated external impersonation scam" affecting a "limited number of customers."

Customer notifications sent around September 11, 2026 indicate the exposed data set includes full name, date of birth, occupation, postal address, email, and phone number; copies of passports and/or driver's licenses; KYC facial-verification selfies; and financial records comprising account statements, IBANs, withdrawal records, and complete transaction histories including Bitcoin-related activity. Revolut says its core systems and customer funds were not compromised — this was a data-disclosure incident against the compliance/KYC request-handling workflow, not a platform intrusion.

On-chain investigator ZachXBT added detail Revolut's notification omitted, stating the operation appears to have specifically targeted high-net-worth users, assessing the goal as building "detailed profiles of wealthy individuals, using their KYC documents and cryptocurrency transaction history linked to their real identities" for potential downstream "fraud, impersonation, or extortion" — a population facing elevated risk of SIM-swapping and physical/cryptocurrency-focused extortion once identity and holdings data is exposed.

The incident escalated on September 13, 2026 when a threat actor began posting leaked identity documents and selfies on X (Twitter) and Telegram, naming specific individuals including professional tennis player Alexander Shevchenko and Felix Römer, CEO of Gamdom and Skinscom (Römer responded publicly on X: "Ah wtf @Revolut"). The Register additionally reported leaked samples attributed to "CEOs, sports professionals, and performing artists." The actor stated: "We're gonna start releasing more and more data everyday until Revolut pays for leaking their customers," separately claimed it would release "more messages, data and commentary on how Revolut's team operates," and accused Revolut of "handing information to countries outside its jurisdiction" and of general negligence around privacy. The actor also demanded a reported ~10,000 BTC (approximately $782M USD) to halt further leaks — a figure surfaced publicly by the dark-web-monitoring account DailyDarkWeb, which itself cautioned that the attacker's identity, the ransom figure, the claimed high-profile victim list, and the authenticity of the leaked material were all unconfirmed and uncorroborated as of publication.

Revolut says it immediately blocked the malicious email address on detection and notified the relevant government agency, law enforcement, data-protection authorities, and financial regulators; it declined to name the impersonated agency on the stated grounds that doing so "would allow other regulated platforms to search their own legal-request logs for messages from the same mailbox." Security researchers questioned Revolut's controls: Muhammad Yahya Patel of Huntress asked why "a regulated financial institution handling highly sensitive data didn't have sufficiently rigorous verification controls to catch it," while Jamie Akhtar of CyberSmart characterized the exposed data set as "a complete identity theft kit" carrying downstream identity-fraud and phishing risk. This is not Revolut's first disclosed breach — the company reported a separate 2022 incident affecting 50,150 customers — underscoring a structural weakness common across fintech/KYC-handling organizations: reliance on email domain authentication (DKIM/SPF-style checks) alone as a trust signal for high-sensitivity legal/regulatory data requests, without an out-of-band verification step (e.g., callback to a known point of contact) before releasing PII, identity documents, or financial records.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1586.002 Email Accounts
- T1199 Trusted Relationship
- T1684.001 Impersonation
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fraudulent Government-Domain KYC/Legal Data Request Email** (`TL-2026-2498-SPL-001`)

Detects an inbound email from a domain-authenticated (SPF/DKIM-pass) government/regulatory agency domain requesting customer KYC, financial, or identity data, where the reply-to address does not match the sending domain or no pre-verified liaison contact exists for that domain. This is the exact pattern Revolut's compliance team was fooled by: an unauthorised mailbox on a legitimate government domain issuing a fraudulent data request that passed domain-authentication checks and was fulfilled as a routine legal-compliance request.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1598, T1656, T1199, T1586.002
- **Data sources:** email_gateway (O365 Message Trace / Proofpoint), email_authentication_logs (DKIM/SPF/DMARC), verified_government_domain_and_liaison_lookup
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
index=email sourcetype="ms:o365:reporting:messagetrace" OR sourcetype="proofpoint:message"
| eval sender_domain=mvindex(split(sender,"@"),1)
| lookup verified_government_agency_domains.csv domain AS sender_domain OUTPUT is_known_gov_domain
| lookup verified_legal_request_contacts.csv domain AS sender_domain OUTPUT verified_liaison_contact
| where is_known_gov_domain="true"
| eval subject_lower=lower(subject)
| where match(subject_lower, "(?i)(kyc|customer data|information request|legal request|subpoena|court order|regulatory request|account information)")
| eval dkim_pass=if(match(authentication_results,"dkim=pass"),1,0), spf_pass=if(match(authentication_results,"spf=pass"),1,0)
| where dkim_pass=1 AND spf_pass=1
| eval reply_to_domain=mvindex(split(reply_to,"@"),1)
| where isnull(verified_liaison_contact) OR reply_to_domain!=sender_domain
| stats count min(_time) as first_seen max(_time) as last_seen values(recipient) as internal_recipients by sender, sender_domain, subject, message_id
| table first_seen, last_seen, sender, sender_domain, subject, internal_recipients, message_id
```

### Microsoft KQL

```kql
EmailEvents
| where Timestamp > ago(24h)
| where AuthenticationDetails has "SPF pass" and AuthenticationDetails has "DKIM pass"
| extend SenderDomainName = tostring(split(SenderFromAddress, "@")[1])
| join kind=leftouter (
    ExternalGovernmentDomains_CL
    | project Domain_s
) on $left.SenderDomainName == $right.Domain_s
| where isnotempty(Domain_s)
| where Subject has_any ("KYC", "customer data", "information request", "legal request", "subpoena", "court order", "regulatory request")
| extend ReplyToDomain = tostring(split(extractjson("$.replyTo", AdditionalFields), "@")[1])
| where isempty(ReplyToDomain) or ReplyToDomain != SenderDomainName
| project Timestamp, SenderFromAddress, SenderDomainName, Subject, RecipientEmailAddress, NetworkMessageId
```

### Sigma

```yaml
title: Fraudulent Government-Domain KYC/Legal Data Request Email
id: e7f1c2a4-6b3d-4f8a-9c2e-1a7d5f3b8e21
status: experimental
description: Detects an SPF/DKIM-authenticated inbound email from a known government/regulatory agency domain requesting KYC, identity, or financial customer data where the reply-to address does not match the sending domain or no pre-verified legal-liaison contact exists for that domain, matching the fraudulent-government-impersonation vector used against Revolut's compliance workflow.
references:
    - https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
    - https://attack.mitre.org/techniques/T1598/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.reconnaissance
    - attack.t1598
    - attack.resource-development
    - attack.t1586.002
    - attack.initial-access
    - attack.t1199
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: application
    product: m365
    service: exchange
detection:
    selection_auth:
        AuthenticationDetails|contains|all:
            - 'SPF pass'
            - 'DKIM pass'
    selection_domain:
        SenderDomainName|endswith:
            - '.gov'
            - '.gov.uk'
    selection_subject:
        Subject|contains:
            - 'KYC'
            - 'customer data'
            - 'information request'
            - 'legal request'
            - 'subpoena'
            - 'court order'
            - 'regulatory request'
    filter_verified_liaison:
        ReplyToDomain: SenderDomainName
    condition: selection_auth and selection_domain and selection_subject and not filter_verified_liaison
falsepositives:
    - Legitimate recurring legal/compliance liaison correspondence from a government domain not yet catalogued in the verified-liaison lookup
    - Government agency address migration not yet reflected in the trusted-contact list
level: high
```

**Known false positives:**

- Legitimate recurring legal/compliance liaison correspondence from a government domain not yet added to the verified-liaison-contact lookup
- Government agency migrating to a new but not-yet-catalogued email address

**Tuning notes:** Maintain and regularly refresh the verified_government_agency_domains.csv and verified_legal_request_contacts.csv lookups from an out-of-band, legal-team-owned source (never from the inbound email itself); alert only on domains present in the government-domain lookup to avoid drowning in ordinary phishing noise.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fraudulent Government-Domain KYC/Legal Data Request Email (locked: unlock with TL Creds)
- Anomalous Bulk KYC Dossier Export Following External Legal-Request Email (locked: unlock with TL Creds)
- Outbound KYC/PII Data Exfiltration Following Bulk Export (locked: unlock with TL Creds)
- Fraudulent Government-Domain KYC/Legal Data Request Email (locked: unlock with TL Creds)
- Anomalous Bulk KYC Dossier Export Following External Legal-Request Email (locked: unlock with TL Creds)
- Outbound KYC/PII Data Exfiltration Following Bulk Export (locked: unlock with TL Creds)
- Anomalous Bulk KYC Dossier Export Following External Legal-Request Email (locked: unlock with TL Creds)
- Outbound KYC/PII Data Exfiltration Following Bulk Export (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Revolut discloses data breach exposing financial info, passports](https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/)
- [Revolut confirms customer data breach through fake government requests](https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/)
- [Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks](https://securityaffairs.com/198922/data-breach/revolut-exposed-kyc-data-after-fraudulent-government-email-passed-security-checks.html)
- [Revolut falls for fake government requests, hands over customer data](https://www.theregister.com/cyber-crime/2026/09/14/revolut-falls-for-fake-government-requests-hands-over-customer-data/5296118)
- [What we know about the Revolut data breach so far](https://www.helpnetsecurity.com/2026/09/14/revolut-data-breach-privacy/)
- [Revolut Handed Over Bitcoin Histories, Passports on Spoofed Government Email](https://www.cryptotimes.io/2026/09/12/revolut-handed-over-bitcoin-histories-passports-on-spoofed-government-email/)
- [Revolut Hackers Begin Leaking Customer Passports and Selfies After a Fake Government Request Cleared Its Checks](https://www.cryptotimes.io/2026/09/14/revolut-hackers-begin-leaking-customer-passports-and-selfies-threaten-daily-dumps/)
- [Revolut Confirms Data Breach Through Fake Government Requests](https://www.infosecurity-magazine.com/news/revolut-data-breach-fake-government/)
- [Revolut Data Breach Exposes Customers' Passport Copies and Full Transaction Histories to Hackers](https://cybersecuritynews.com/revolut-data-breach/)
- [Revolut Leaks Passports, Bitcoin Transaction Histories to Fake Government Request](https://decrypt.co/378114/revolut-passports-bitcoin-activity-data-breach)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2498