Revolut, the prominent fintech company, is currently addressing claims that a database containing records of over 75 million users is being sold on cybercrime forums. The company, however, asserts that there is no evidence supporting a new data breach.
A threat actor has advertised what they claim to be a Revolut customer database, allegedly comprising 75 million records. Samples provided include partial card data, email addresses, full names, phone numbers, physical addresses, account identifiers, device information, and hashed user credentials. Notably, the dataset is reportedly being offered for approximately $500, a price that raises suspicions given the volume of data purportedly involved.
Security researchers analyzing the samples observed the inclusion of payment card details—such as the last four digits, card type, expiration dates, and card status—as well as personally identifiable information like email addresses, names, countries, and registration IPs. Additionally, the dataset appears to contain bcrypt or argon2id password hashes, along with metadata on device models and operating systems, which could facilitate detailed profiling of targeted users.
Initial assessments suggest that the records may extend up to around May 2025. Investigators have not linked the samples to any previously documented incidents involving Revolut, indicating the possibility that the data is aggregated from multiple sources rather than stemming from a single new compromise.
Revolut is aware of the forum listing but strongly disputes the validity of the alleged breach. According to a CyberWatch post on X, the company stated that the claim lacks a verifiable record count, meaningful data samples, or technical evidence indicating a new compromise. Revolut emphasizes that its internal monitoring and security controls have not detected signs of unauthorized access related to this purported leak and confirms that an ongoing investigation is underway.
In 2022, Revolut disclosed a targeted social engineering attack that exposed data for approximately 50,150 customers, about 0.16% of its then-20 million-user base. This earlier breach involved access to personal details, including names, addresses, email addresses, phone numbers, and partial card data, but did not permit direct access to customer funds.
If the newly reported leak of 75 million records is legitimate, it would represent a significantly larger event than the 2022 incident, greatly increasing the risk of phishing, identity theft, and financial fraud against Revolut’s global user community. Even without full verification, the presence of detailed contact information and partial card data in criminal marketplaces can facilitate highly convincing phishing and social engineering campaigns targeting Revolut customers.
Users are advised to treat unsolicited messages referencing Revolut with caution, avoid clicking on embedded links, and authenticate communications only through official channels and in-app notifications. Enabling multi-factor authentication, regularly changing credentials, and closely monitoring account activity for suspicious transactions are essential steps while investigators work to confirm or debunk the hackers’ claims.
As the situation develops, it is crucial for Revolut users to remain vigilant and proactive in safeguarding their personal information. The fintech industry, given its rapid growth and reliance on digital platforms, remains a prime target for cybercriminals. This incident underscores the importance of robust security measures and prompt responses to potential threats to maintain user trust and data integrity.
