Identity documents and selfies belonging to customers of Revolut have appeared online after hackers published the material and threatened to leak more data on a daily basis unless the fintech firm pays a ransom.
The attackers have not disclosed how much money they are demanding, nor how many customers are affected. Their identity has also not been made public. What is known is the nature of the threat: a rolling release of stolen data intended to pressure Revolut into paying, with the promise that fresh material will surface each day the company does not meet the demand.
For a firm that operates across the European Union and beyond, offering banking and payment services to millions of retail customers, the exposure of government-issued identification alongside selfies used for account verification is a serious matter. These are precisely the documents financial platforms rely on to confirm a customer's identity during onboarding, and their circulation outside the company's systems raises the risk of identity theft and fraud for those affected.
What remains unconfirmed
Several details of the incident have not been established. The scale of the breach, in terms of how many Revolut users had their documents exposed, has not been specified. The sum the attackers are seeking has also not been made public. Nor is there any confirmed information about who is behind the extortion attempt.
Revolut has not issued a statement addressed in this brief, and no comment from the company is available at this time.
The episode adds to a pattern of ransom-style extortion campaigns targeting financial and technology firms, where stolen personal data is used as leverage rather than sold outright. For customers, the practical concern is more immediate: identity documents and selfies, once published, are difficult to retract from circulation regardless of whether a ransom is eventually paid.
European regulators have increasingly scrutinised how fintech firms handle sensitive verification data, and incidents of this kind are likely to renew questions about the security measures surrounding customer onboarding processes across the sector. Until further details emerge on the extent of the breach and any response from Revolut, customers face uncertainty over whether their own documents form part of the material already published or still to come.
