The Revolut data breach disclosed last weekend appears to have been far more targeted than initially known. Around 680 customers were affected, and hackers claiming responsibility say they deliberately selected accounts associated with significant cryptocurrency holdings using blockchain analysis.
Revolut initially described the number of victims only as “very limited.” A source close to the case has now confirmed that roughly 680 customers were affected across several European countries. Most are believed to be based in Switzerland and France, with victims also identified across 31 other mainly European markets.
The attackers claim they compromised an Italian government email system and spent several months impersonating law-enforcement officials. Requests for specific Revolut accounts were sent through Italy’s PEC certified-email infrastructure, which is used for legally recognized communications between public authorities, businesses and individuals.
Because the requests originated from a legitimate government channel, Revolut supplied information including home addresses, phone numbers and transaction histories. Previously disclosed notifications show that affected records could also include identity documents, verification photographs, IBANs and Bitcoin transaction histories.
The most important new detail is the apparent selection process. The hackers told the Financial Times that the 680 requests were not random. Blockchain analysis was allegedly used to identify Revolut customers with substantial crypto holdings before their personal information was requested. That claim has not been independently verified.
Such targeting considerably changes the risk profile of the breach. Combining cryptocurrency wealth indicators with physical addresses, identity documents and transaction histories could expose victims not only to fraud and identity theft but potentially to physical extortion attempts.
Revolut maintains that its internal systems and customer funds were not compromised. The company says it blocked the fraudulent address and notified law enforcement, regulators and affected customers. Revolut also says it has not been contacted by the attackers and has received no ransom demand, despite claims that stolen data could be published.