TechCrunch (12 September 2026) and BleepingComputer (14 September) report Revolut confirmed it disclosed sensitive customer information to an unauthorised third party after fraudulent information requests were sent from a legitimate government-agency email domain.

SecurityWeek (17 September 2026) reports that a threat actor using the name 'IAmNotAVillain' publicly demanded US$3 million, threatening to sell the data, and that Revolut said it had received no direct contact or demand; SecurityWeek says it understands about 680 customers were affected, and, citing Hudson Rock's contact with the hacker, that the fake requests impersonated an Italian government agency and ran for about five months (the hacker's own claim).

Revolut has not published a number. A Revolut spokesperson described a sophisticated external impersonation scam; the company blocked the mailbox, alerted the agency, law enforcement and regulators, and said systems and customer funds were unaffected. Customer notifications list identity and contact details (name, date of birth, postal/email addresses, phone), copies of passports or driver’s licences, facial verification selfies, account statements (including IBAN), withdrawal records, and full transaction histories (including Bitcoin activity).

Primary: TechCrunch with Revolut confirmation; NEW scope wire: SecurityWeek 17 Sep; secondary: BleepingComputer 14 Sep; not a core-system compromise.

Correction (22 Oct 2026): an earlier version presented the 680-account figure, the five-month duration and a US$3 million ransom demand as established facts; they come from SecurityWeek and the threat actor, and Revolut told SecurityWeek it had received no demand. (source: https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/)