Threat Actor Claims Revolut Data Breach Exposes Financial Records of 75 Million Users

A threat actor has reportedly claimed to possess and sell a large dataset allegedly linked to the fintech company Revolut, purportedly affecting more than 757 million users.

This claim, circulated by the CyberWatch threat intelligence account on X, suggests that the dataset contains sensitive customer and account-related information.

However, the dataset has not been independently verified. At the time of writing, Revolut has not publicly confirmed that a breach has occurred.

Revolut Data Breach Exposes Financial Records

According to the post, the allegedly compromised data may include payment card details, user credentials, device information, customer profiles, account-related records, and multiple CSV files containing user data. The exact nature, age, source, and authenticity of the purported records remain unclear.

It is also unknown whether the claimed figure of 757 million represents unique Revolut customers, duplicated entries, scraped information, historical data from a third party, or a mixture of legitimate and fabricated records.

If the data is authentic, the exposure of financial service data could pose significant downstream risks for affected individuals. Threat actors could utilize usernames, passwords, device fingerprints, and profile information to conduct credential-stuffing campaigns, account takeover attempts, targeted phishing, social engineering fraud, and identity theft.

If payment card information is included, victims may also face attempts at unauthorized transactions or card testing. However, the post does not clarify whether full card numbers, expiration dates, CVV values, or tokenized payment records are part of the dataset.

Organizations and security teams should treat marketplace claims with caution until technical validation is available. Cybercriminals frequently exaggerate breach sizes, relist old datasets, combine data from multiple unrelated sources, or use public and scraped information to inflate a listing’s perceived value.

Verification typically requires assessing a controlled sample for data freshness, formatting consistency, unique internal identifiers, and evidence that links the records to the affected organization, without unnecessarily exposing personal information.

Revolut users should remain vigilant for unexpected password reset messages, fake compliance notifications, fraudulent payment alerts, or calls claiming to originate from the company’s support team.

Users are advised to enable multi-factor authentication, use a unique and strong password for their Revolut account, review recent transactions and linked devices, and promptly report any suspicious activity through official Revolut support channels. Customers should avoid using links or phone numbers provided in unsolicited communications.

As of now, Revolut has not confirmed the alleged incident. Until either the company or independent researchers validate the claim, the reported dataset should be treated as unverified threat intelligence information rather than evidence of a confirmed data breach.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.