The group known as ImNotAVillain has listed Revolut on its leak site, claiming that data belonging to the company was made available for sale. The listing asserts that information related to 680 high-value, high-net-worth users was included. Revolut has not publicly confirmed any breach or data theft as of this writing.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Revolut
Get alerted the next time Revolut files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Revolut’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
If the claim is accurate, the affected individuals face the standard risks that come when customer financial records appear in extortion listings. Even without knowing the exact fields, the presence of any account-related information can enable targeted phishing, account takeover attempts, or impersonation. What matters most is that you still control your accounts and can act now to limit what an attacker could do with any stolen details.
A 12-Day Gap Between Claimed Incident and Listing
The record shows the claimed incident date of September 12, 2026 and the listing appearing on September 24, 2026 — just 12 days later. Ransomware-extortion groups frequently publish listings on leak sites quickly to create urgency and pressure the target into paying. This short window is common in these operations and does not, by itself, prove the validity of the claim.
What a Leak-Site Listing Actually Establishes
Leak-site postings are produced entirely by the claiming group. They require no independent verification, no regulator sign-off, and no confirmation from the named company. Many such listings later turn out to be recycled data from older incidents, exaggerated claims, or outright fabrications designed to force a ransom payment. A listing alone does not constitute evidence that a breach occurred, that any specific data was taken, or that the claimed 680 users were actually impacted. Real confirmation would require an admission by Revolut, a regulatory filing detailing the incident, or forensic evidence released by a trusted third party. Until then, this remains an unverified accusation by an extortion crew.