Hackers trick Revolut into handing over data from nearly 700 customers

Hackers obtained sensitive data from nearly 700 Revolut customers after impersonating Italian law enforcement, according to SRF. The British online bank released the information believing it was responding to an official investigation.

The hackers did not breach Revolut directly. Instead, they compromised the communication channel of an Italian authority and used it to pressure the bank into cooperating with a supposed investigation.

The stolen information included passport details, account numbers and addresses, but no money was taken. Revolut confirmed the incident. The Financial Times reported that customers in Switzerland were particularly affected.

More than one million people in Switzerland use Revolut. Most currently use it as a supplementary account, often for payments abroad because of the comparatively low fees.

The hackers are demanding three million dollars in exchange for not publishing the data. They posted the ransom demand on a website rather than contacting Revolut directly. SRF business editor Pascal Lago said the unusual approach raised questions about whether money was the only motive.

The compromised channel was PEC, Italy’s certified electronic mail system, an official communication channel used by authorities and companies for legal and administrative correspondence. Italian authorities are investigating whether other government bodies were also compromised and whether the hackers accessed data belonging to additional companies.

The incident comes as Revolut seeks to expand in Switzerland. The bank applied for a Swiss banking licence this week and plans to offer salary accounts. The incident could damage its reputation as it seeks to strengthen its presence in the country.