Neobank Revolut is embroiled in a major security crisis following the public disclosure of confidential user data. Initially dismissed as an isolated breach involving identity theft, the incident has taken a sharp turn for the worse. The hackers responsible have now escalated their attacks by leaking documents from the Know Your Customer (KYC) verification procedures of several high-profile clients, while demanding a ransom payment to halt the further release of private information.
The exposed data includes sensitive material such as government-issued IDs and verification selfies belonging to prominent figures in the tech and sports sectors, including the head of crypto betting platforms, Felix Römer. The attackers, who are using screenshots as proof of their intrusion, are openly accusing the financial institution of gross negligence and the illegal transfer of data outside its jurisdiction. This pressure tactic, a hallmark of ransomware groups, aims to force the company to comply or face the leak of extensive internal communications.
This development comes at a pivotal moment for Revolut, which is looking to expand its international banking footprint, most notably with the recent agreement in principle to operate in the United States by 2027. Repeated incidents of this nature—following similar reports in 2022 and earlier this year—are significantly undermining the platform's credibility regarding cybersecurity. Beyond the reputational risk, the breach of personally identifiable information directly exposes wealthy clients to physical threats and targeted extortion attempts.
The implications of this case extend far beyond the company itself. In France, law enforcement has already documented the use of stolen customer files in cases of kidnapping and violent crypto-extortion. Revolut's ability to protect user privacy is now at the heart of a critical debate, at a time when trust is a non-negotiable pillar of its business model. The financial industry as a whole is closely monitoring the handling of this crisis, which highlights the growing dangers facing digital institutions that store highly confidential information on an international user base.