Revolut Data Breach Exposes 680 Customers via Social Engineering

• •Revolut's breach affected 680 high-net-worth customers due to social engineering.
• •The hacker used a compromised government email to request sensitive KYC data.
• •IDScan's breach highlights risks in third-party KYC vendor dependencies.

In September 2026, Revolut confirmed a significant data breach affecting 680 customers, primarily high-net-worth individuals from Europe. The breach was initiated by a hacker posing as an Italian law enforcement agency, leveraging social engineering to request sensitive KYC information. The exposed data included passport copies, verification selfies, and transaction histories. The hacker, known as iamnotavillain, used blockchain analytics to identify targets and has since leaked some of the KYC information, demanding a $3 million ransom. This incident highlights vulnerabilities in third-party KYC vendors and the risks associated with trusting specific email domains. Additionally, IDScan, a KYC vendor, reported unauthorized access to identity information on its platform, further complicating the situation for financial institutions relying on its services. The surge in deepfake fraud attempts in the financial sector adds to the growing cybersecurity concerns.