Digital bank Revolut is facing a public extortion campaign after criminals began publishing identity files taken from a recent customer-data incident, just as the company presses ahead with plans to enter Israel.
The firm has confirmed that an unauthorized party obtained sensitive records after submitting fraudulent information requests from an email address on a genuine government-agency domain.
Because the domain was authentic and passed technical checks, Revolut staff treated the requests as official and released the material.
The company later said it blocked the address, notified the relevant authority, and alerted law enforcement, data-protection bodies and financial regulators.
It has also stated that its core systems were not compromised and that customer funds remain unaffected.
Affected customers were told the disclosed material could include full names, dates of birth, occupations, postal and email addresses, phone numbers, copies of passports or driving licences, facial-verification selfies taken during onboarding, account statements and complete transaction histories, including Bitcoin activity.
‼️ BREAKING: The threat actors who targeted Revolut with information-demand emails are now posting sensitive customer data, including that of high-profile clients such as tennis player Shevchenko and Römer, CEO of Gamdom/Skinscom.
They want Revolut to pay up. They say they'll… pic.twitter.com/obuVOOABx7
— International Cyber Digest (@IntCyberDigest) September 13, 2026
Revolut has described the number of people involved as limited and said it contacted those customers directly.
It has not published an exact figure, named the government agency whose domain was used, or said whether the incident was confined to one country.
Independent researchers have said the requests appeared aimed at high-net-worth users rather than a mass dump of the firm’s entire customer base.
The situation escalated over the weekend when the same threat actors began posting some of the files online.
According to reporting that first circulated on X, the published material included identity documents and verification selfies belonging to Revolut customers, among them tennis player Alexander Shevchenko and Felix Römer, chief executive of online casino operator Gamdom.
On Telegram, the attackers said they would keep releasing more records every day until Revolut “pays for leaking their customers.”
They have also accused the company of negligence and of handing data to parties outside its proper jurisdiction, and have threatened to publish further details about how internal teams handled the requests.
The exposure of government-issued identity papers alongside live facial images raises a different risk than a typical email-and-password leak.
Combined with addresses, contact details and full payment histories, the package can be used for identity theft, targeted phishing and social-engineering attacks that look unusually convincing.
Revolut has drawn a distinction between the selfie photographs themselves and derived biometric templates, saying the latter were not involved.
The timing is awkward for the company’s Israeli expansion.
Revolut has not yet launched full banking operations in Israel, though thousands of Israelis living or previously living abroad may already hold accounts opened elsewhere.
The company already holds a local payment-services licence and is seeking a “lean bank” licence from the Bank of Israel that would allow deposits and credit.
Israeli officials have viewed a large international digital bank as a potential source of competition for the country’s concentrated banking sector.
The incident is unlikely to affect most domestic customers immediately, but it could colour public and regulatory scrutiny of how the firm authenticates official data requests.
The episode is not a conventional network intrusion.
It exploited the human and process layer around lawful-access requests: a real government domain, valid email authentication, and internal procedures that treated those signals as sufficient.
For a firm that now serves tens of millions of customers across dozens of markets, that distinction may matter less to users than the result. Identity documents and selfies are now circulating, and the people who obtained them say they intend to keep publishing unless they are paid.