Attackers who obtained sensitive Revolut customer information appear to have begun publishing the data online, while threatening to release more every day unless the fintech pays.
Cointelegraph updated its report at 09:55 UTC on Sept. 14 to add a comment from Felix Römer, one of the Revolut customers whose details appear in the leak. The newly exposed material reportedly includes selfies and copies of identity documents belonging to tennis player Alexander Shevchenko and Römer, the CEO of online crypto casino Gamdom, according to a Sunday post on X from International Cyber Digest.
Attackers threaten daily releases
The attackers reportedly said on Telegram: "We’re going to start releasing more and more data everyday until revolut pays for leaking their customers."
The leaked identity documents and facial-verification images could raise the risk of identity theft. Revolut told customers on Friday that the exposed data also includes full names, dates of birth, occupations, contact information, account statements and full transaction histories, including records of Bitcoin transactions.
Revolut links the leak to an impersonation scam
Revolut did not give Cointelegraph any additional comment beyond a statement provided on Saturday. In that statement, the company said the breach was caused by a "sophisticated external impersonation scam," where an attacker used an email address from a legitimate government agency domain to submit fraudulent requests for information.
The company also said the breach affected a "limited number" of customers, and that its systems and customer funds were unaffected.
Customer named in leak says details appear to match Revolut data
Römer told Cointelegraph that, based on the details held by the attackers, the information appeared to have come from Revolut. He also confirmed that he was one of the customers contacted by Revolut on Friday.