How Could the Revolut Data Breach Have Been Avoided? A Financial Crime Expert Weighs In

The data breach involving hundreds of customers of the neobank Revolut should be viewed as a combination of a cyberattack and a failure in the bank’s internal procedures, according to Marco Beranzoni, a financial crime prevention specialist and founder of the FinCrime Agent platform. He has over 20 years of experience in financial crime prevention, compliance and financial crime technology, having held positions at some of the world’s largest financial institutions, including HSBC, Standard Chartered, and Bank of America Merrill Lynch.

In a comment to Oninvest Beranzoni describes this incident as a sophisticated impersonation attack, but not necessarily a technically complex intrusion into Revolut’s systems. If the request came from a compromised or apparently legitimate government email account, it could pass normal email authentication and appear credible to the employee reviewing it.

“Overall, this appears to be a combination of cybersecurity and process failure. The attackers may have compromised or abused government communications infrastructure, but the release of information points to weaknesses in how high-risk data requests were authenticated and approved. Email security alone cannot solve this problem if a message comes from a genuine but compromised account," expert claims.

In his view, the main question now is whether the request was independently verified before any customer data was released.

Beranzoni adds that if a request is urgent, it can create a particular vulnerability, since the urgency is used as a justification for bypassing standard legal procedures. “Banks and fintechs should independently confirm the agency, the officer and the request through a trusted channel that is not provided in the request itself. Calling a telephone number included in the same email or document is not sufficient,” the expert emphasizes.

Sensitive disclosures should also require a second reviewer, even where the request appears urgent, the financial expert adds. 

He also expresses concern that attackers obtained data on customers with significant cryptocurrency holdings and identified those customers through blockchain analysis.

“Public blockchain data can help criminals identify valuable wallets, while leaked KYC information can connect those wallets to real people, addresses and identity documents. Even if no funds were taken during this incident, affected customers could face targeted phishing, account takeover attempts, extortion or potentially physical security risks,” warns Beranzoni.

Revolut first reported the incident on September 11. Hackers who call themselves “ImNotAVillain” claimed responsibility for the leak of Revolut customer data. According to the Financial Times, they hacked into an Italian government email system and spent several months posing as law enforcement officials. This allowed them to obtain confidential information about the neobank’s customers. The attackers gained access to information on approximately 680 customers.

The IAmNotAVillain group later demanded a $3 million ransom from Revolut for customer data, threatening to sell the information.

"Revolut has not received any direct contact or demand from the individuals or group making these claims," a Revolut representative said in a written comment to Oninvest.

The incident involving the transfer of customer data by the neobank comes amid Revolut’s large-scale international expansion. In 2026 alone, the fintech company obtained a full banking license in the United Kingdom, followed by one in France in August, and in early September received conditional approval for a license in the United States; it continues to expand its presence in other jurisdictions.

At the same time, the neobank is preparing for a potential public market debut. According to the company’s founder, Nick Storonsky, the IPO could take place no earlier than 2028. According to the Financial Times, the bank’s goal is to become a global player by that time, with a valuation of up to $200 billion. As Oninvest reported, citing expert estimates, Revolut’s ambition does not seem unattainable given the current growth in revenue, profits, and customer base.