Revolut Didn't Get Hacked. It Got Asked.

Nobody broke into Revolut. No exploit. No phished admin. Somebody sent an email from a real government domain asking for customer records, and Revolut sent them.

Now that somebody wants 10,000 Bitcoin for their trouble. Call it $780 million.

I've worked a lot of incidents. This one bugs me more than most, because there was nothing to patch.

What we know so far

Revolut confirmed it to TechCrunch on September 12. An unauthorized third party used a legitimate government agency's email domain to file data requests. Revolut processed them like any other request. The fraud got caught after the fact, the address got blocked, regulators got called. Standard cleanup.

The data is the problem. The Register lists passports, driver's licences, the selfies people take to verify their identity, account statements, IBANs, withdrawal and transaction history including crypto. Plus the basics: name, birthday, address, phone, email, occupation. If you wanted to build a complete fake version of a person, that's the shopping list.

Revolut says a “limited” number of customers out of 80-odd million. It won't say how many. It won't say which agency. It won't say what check was supposed to stop this.

Then it got loud. A crew calling itself Revolut Smilik told City AM it wants 10,000 BTC, and it's using Telegram to promise “more and more data everyday” until it gets paid. Screenshots are floating around that look like records of high-value customers. A few named people have reportedly already been dumped.

Worth saying plainly: Revolut hasn't confirmed the demand, and nobody outside the crew has verified the whole dataset. Extortion groups pad leaks. They always have. The $780 million number is a press release. The breach isn't.

This is a paperwork attack

Every big platform has an inbox for legal requests. Police, courts, regulators, emergency disclosure. The entire point of that inbox is to say yes fast when a real authority asks. Nobody designs it to say no.

Criminals worked that out a long time ago.

Apple and Meta both gave up customer data in 2021 to people sending forged emergency requests from hacked police accounts. Discord got hit the same way. In November 2024 the FBI put out a formal notice saying criminals were openly selling .gov email credentials on forums, with instructions on how to use them for fake emergency requests that skip the lawyers.

So there's nothing new here. It's an old trick that still works because fixing it is boring and it's never clear whose job it is.

Somewhere inside Revolut, a person or a workflow looked at a real domain and decided that meant a real request. It doesn't. An email from a government domain proves exactly one thing: someone can send email from that domain. A contractor with stale access. A small agency running weak MFA. A mailbox nobody decommissioned. Any of those puts a criminal behind an address you'd never think to doubt.

Why the smart companies keep failing this

The request process is built for speed on purpose. A real emergency disclosure request might have hours to work with, so the workflow is tuned to move and not to argue. Attackers know that. They write urgent, they discourage callbacks, and the urgency does the rest.

It also sits with the wrong people. Legal and compliance teams are good at deciding whether a request is lawful. They're not trained to decide whether the sender is who they claim to be. That's a security question, and security usually isn't copied on the email.

Revolut runs some of the better customer fraud detection in fintech. It just never pointed that skepticism at its own inbox.

Ignore the ransom

Ten thousand Bitcoin is a number designed to get reported. No real company wires $780 million to a Telegram handle, and the crew knows it. The demand exists to make headlines, scare the customers whose names are on the list, and soften Revolut up for a smaller quiet deal.

The math doesn't matter anyway. Passports don't rotate. A verification selfie never expires. Everybody in that dataset just became a permanent better target for SIM swaps and account takeovers, and for the kind of crime that shows up at your door. Paying changes none of that.

Whether Revolut pays is a question for Revolut. The question for everyone else is what your legal request inbox would do with the same email tomorrow.

What to do about it

If you're a bank, a fintech, a telco, or a SaaS company that governments ask for customer data, this is your problem. If you're an MSP, it's your clients' problem, just smaller: a help desk that can be talked into a password reset is the same failure with fewer zeros.

Treat every request as an identity problem before it's a legal problem. Confirm the requester is real before anyone evaluates the request. Out of band. Call the agency back on a number you already had, not the one in the signature. Ask for a case number and check it through a channel the sender doesn't control. Yes, this annoys real investigators. They'll live.

Slow emergency requests down on purpose. A real emergency survives a 30-minute verification. A fake one doesn't. Anything that demands action right now and discourages you from calling back should go up a level, not through faster.

Get security into the approval. If legal can release passport scans without a second person from security signing off, fix that this month. Two people for anything involving government ID, financial history, or biometrics. A real control, not a paragraph in a policy.

And hold less. Revolut lost selfies and passport scans because Revolut still had selfies and passport scans. Most companies keep KYC material years past any reason to. What you've deleted, you can't be tricked into handing over.

Then test it. Send your own fake government request to your own legal inbox and watch what happens. Cheapest tabletop you'll ever run. I'd bet most companies fail it the first time.

The part that matters

Revolut's systems held. Its judgment didn't. The attackers went around every control the company paid for by asking nicely from an address that looked like it deserved an answer.

The easiest way into a hardened company is the door it built to let authority in. Yours has one too.