# Revolut Discloses Customer Data Breach Orchestrated via Fraudulent Government Legal Requests Source: TechNewsList (https://technewslist.com) Canonical URL: https://technewslist.com/en/article/revolut-customer-data-breach-fraudulent-government-compliance-requests-2026-09-1 Section: Fintech (https://technewslist.com/en/fintech) Author: TechNewsList Language: en Published: 2026-09-14T05:20:17.638+00:00 Updated: 2026-09-14T05:20:17.803744+00:00 > Cybercriminals exfiltrate Revolut customer records by forging law enforcement emergency data requests, triggering extortion threats and an industry-wide review of legal portal authentication. ## TL;DR - Revolut confirmed malicious actors accessed customer data using fraudulent law enforcement emergency disclosure requests. - The exfiltrated records include customer names, registered email addresses, phone numbers, and masked account identifiers. - Core financial credentials, payment card numbers, and account passwords remained encrypted and uncompromised. - European and UK banking regulators launched formal inquiries into automated legal compliance intake systems across the fintech sector. ## Key points - Attackers leveraged compromised police and government agency email domains to submit forged emergency data subpoenas. - Revolut's automated compliance processing systems fulfilled several fraudulent requests before manual review flagged anomalies. - Threat actors launched a dedicated extortion site threatening rolling daily data leaks unless a cryptocurrency ransom is paid. - Revolut suspended automated legal request processing and transitioned all government subpoenas to multi-signature manual verification. - No customer funds were directly accessed or stolen during the security compromise. - The incident highlights systemic vulnerabilities across fintech legal intake systems that rely on domain validation rather than cryptographic signing. ## What happened On September 12, 2026, global financial technology giant Revolut formally confirmed that unauthorized third parties compromised customer records by exploiting the company's automated legal compliance ingest workflow. The breach occurred when threat actors successfully submitted forged emergency data disclosure requests using compromised official email domains belonging to municipal law enforcement agencies. The incident was detected when internal security operations analysts identified anomalous query frequencies originating from previously verified legal intake channels. By the time security teams revoked the associated access credentials, the attackers had exfiltrated thousands of customer records containing personal identification details, contact information, and partial transaction histories. Following the disclosure, the threat actors established a darknet extortion portal threatening to publish rolling daily tranches of stolen customer data unless Revolut paid an undisclosed ransom in privacy-focused cryptocurrency. Revolut promptly notified the United Kingdom Information Commissioner's Office, the Financial Conduct Authority, and international law enforcement agencies, stating unequivocally that the company will not negotiate with cyber extortionists. ## Why it matters This security incident illuminates a dangerous and rapidly evolving attack vector targeting financial institutions worldwide: the weaponization of lawful access and emergency data disclosure systems. Under international telecommunications and banking regulations, financial platforms maintain streamlined intake pathways allowing law enforcement officers to request urgent customer metadata in life-or-death investigations without waiting for standard judicial subpoenas. ![Customer disclosure alerts and compliance warnings regarding portal breach](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1789363207109-vkkgf4-revolut-customer-data-breach-fraudulent-government-compliance-requests-2026-09-1-inside-1-12b02671ef.webp) Historically, corporate compliance departments verified emergency requests by confirming that inbound communications originated from legitimate government domain names (.gov, .police.uk, or regional equivalents). However, sophisticated cybercriminals frequently gain access to small municipal police department email servers through basic credential stuffing or phishing attacks. Once inside a legitimate government mail system, attackers can submit seemingly authentic emergency requests that bypass standard automated security filters. For consumers, the exposure of contact information and transaction metadata creates severe secondary risks. While attackers cannot directly withdraw funds without passwords and multi-factor authentication, possessing detailed customer profiles enables highly targeted spear-phishing campaigns where criminals pose as Revolut fraud specialists to deceive victims into transferring their savings. ## Technical details Forensic investigations conducted by external cybersecurity incident response teams determined that the attackers exploited Revolut's API-driven legal request intake pipeline. The service was designed to parse structured legal requests received from accredited law enforcement contacts, automatically matching customer phone numbers and national identification identifiers against internal production databases to expedite response times. The attackers submitted dozens of crafted emergency requests over a seventy-two-hour window, each claiming imminent threats to human life requiring instantaneous disclosure. Because the incoming messages originated from verified foreign police mail servers that passed standard SPF, DKIM, and DMARC email authentication checks, Revolut's automated ingest engine processed the queries without triggering initial fraud alarms. Revolut confirmed that core cryptographic hardware security modules containing user passwords, private payment keys, full sixteen-digit payment card numbers, and card verification codes were isolated from the legal compliance intake environment. Consequently, no transactional credentials or direct fund management mechanisms were exposed during the intrusion. ## Market / industry impact The disclosure has triggered an immediate crisis response across the European fintech sector. Competing neobanks, including Monzo, N26, and Starling Bank, initiated emergency security audits of their respective law enforcement intake portals to determine whether similar spoofing techniques were attempted against their platforms. ![Incident response telemetry tracking fraudulent database query patterns](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1789363209722-4o7yc1-revolut-customer-data-breach-fraudulent-government-compliance-requests-2026-09-1-inside-2-c67ee5129c.webp) The UK Financial Conduct Authority and the European Banking Authority issued joint supervisory advisories instructing all regulated financial institutions to immediately suspend automated processing of emergency data requests. Moving forward, compliance departments must enforce mandatory out-of-band verification, requiring compliance staff to confirm requests via independent telephone callbacks or cryptographic public key verification before releasing customer records. The incident is also expected to accelerate calls for centralized government verification clearinghouses. Rather than requiring individual private companies to authenticate thousands of municipal police agencies worldwide, industry trade groups are lobbying for a unified federal gateway where all official data requests must be digitally signed and verified through a single government authority. ## What to watch next In the coming weeks, privacy regulators will evaluate whether Revolut's automated data disclosure processes violated the General Data Protection Regulation. If regulators find that the company failed to implement appropriate organizational and technical safeguards against predictable social engineering attacks, Revolut could face substantial financial penalties. Revolut's incident response teams are actively collaborating with national intelligence services to disrupt the threat actor's extortion infrastructure and identify the specific law enforcement accounts that were compromised to launch the campaign. Affected customers will receive tailored security guidance and complimentary identity theft monitoring services. Financial institutions will watch closely to see if other digital banks report similar unauthorized disclosures, which would confirm that cybercrime syndicates have systematically indexed and weaponized government email access across the international banking ecosystem. ## Sources - [TechCrunch Security Investigation](https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/) — TechCrunch breaks Revolut's formal notification disclosing unauthorized access via spoofed government legal requests. - [CoinTelegraph Fintech Cybersecurity](https://cointelegraph.com/news/revolut-says-customer-data-exposed-through-fake-government-email) — Independent corroboration detailing the specific law enforcement portal vectors used to exfiltrate account metadata. - [CoinTelegraph Threat Intelligence](https://cointelegraph.com/news/revolut-attackers-threaten-daily-customer-data-leaks) — Reporting on extortion demands and threat actor leak site claims following the exfiltration of user records. Mentions: Revolut, Financial Conduct Authority, National Cyber Security Centre, Interpol, European Banking Authority ## Sources - [TechCrunch Security Investigation](https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/) - [CoinTelegraph Fintech Cybersecurity](https://cointelegraph.com/news/revolut-says-customer-data-exposed-through-fake-government-email) - [CoinTelegraph Threat Intelligence](https://cointelegraph.com/news/revolut-attackers-threaten-daily-customer-data-leaks)