Revolut Faces Alleged Data Breach of 75 Million User Records
Revolut is investigating claims that a threat actor is selling a database containing records of over 75 million users on a cybercrime forum. The company, however, has stated it has found no evidence of a new breach.
The dataset, advertised for approximately $500, includes partial card details (last four digits, card type, expiration dates, and status), email addresses, full names, phone numbers, physical addresses, account identifiers, device information, and hashed credentials (bcrypt or argon2id). Security researchers who reviewed samples noted the data could enable targeted phishing and identity theft campaigns.
Initial analysis suggests the records may span up to May 2025, though investigators have not linked them to any prior Revolut incidents. The company has dismissed the claims, stating the alleged breach lacks verifiable evidence, such as a confirmed record count or technical proof of compromise. Revolut maintains its security systems show no signs of unauthorized access.
This follows a 2022 breach where a social engineering attack exposed data for roughly 50,150 users less than 0.2% of its user base at the time. If verified, the current leak would represent a far larger exposure, significantly increasing risks of financial fraud and phishing for Revolut’s global customer base. The investigation remains ongoing.
Source: https://cybersecuritynews.com/revolut-alleged-data-breach/
Revolut cybersecurity rating report: https://www.rankiteo.com/company/revolut
"id": "REV1785335106",
"linkid": "revolut",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '75,000,000 (alleged)',
'industry': 'Fintech',
'location': 'Global',
'name': 'Revolut',
'size': 'Large',
'type': 'Financial Services'}],
'customer_advisories': 'Public statement denying evidence of breach',
'data_breach': {'data_encryption': 'Hashed credentials (bcrypt or argon2id)',
'data_exfiltration': 'Alleged (data advertised for sale on '
'cybercrime forum)',
'number_of_records_exposed': '75,000,000 (alleged)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Partial card details',
'Email addresses',
'Full names',
'Phone numbers',
'Physical addresses',
'Account identifiers',
'Device information',
'Hashed credentials']},
'description': 'Revolut is investigating claims that a threat actor is '
'selling a database containing records of over 75 million '
'users on a cybercrime forum. The dataset includes partial '
'card details, email addresses, full names, phone numbers, '
'physical addresses, account identifiers, device information, '
'and hashed credentials. The company has found no evidence of '
'a new breach.',
'impact': {'brand_reputation_impact': 'Potential significant impact due to '
'scale of alleged breach',
'data_compromised': 'Partial card details (last four digits, card '
'type, expiration dates, status), email '
'addresses, full names, phone numbers, '
'physical addresses, account identifiers, '
'device information, hashed credentials',
'identity_theft_risk': 'High',
'payment_information_risk': 'Moderate (partial card details '
'exposed)'},
'initial_access_broker': {'data_sold_on_dark_web': 'Alleged'},
'investigation_status': 'Ongoing',
'motivation': 'Financial Gain',
'references': [{'source': 'Cybercrime forum advertisement'}],
'response': {'communication_strategy': 'Public statement denying evidence of '
'breach',
'incident_response_plan_activated': 'Yes (investigation '
'ongoing)'},
'title': 'Revolut Alleged Data Breach of 75 Million User Records',
'type': 'Data Breach'}