Swiss-based Revolut customers targeted in data breach

Nearly 700 Revolut customers have had their account data exposed after criminals impersonated Italian law enforcement officials. The attackers pressured the online bank to release information they claimed was needed to complete an investigation. Revolut accepted the request, believing it came from a legitimate authority, and the data then reached the criminals.

The hackers later published a ransom demand online. They are asking Revolut to pay US$3 million in exchange for withholding the customer information. The source report does not identify the precise categories of data involved, and it does not say whether payment negotiations are under way.

Some of the affected clients are based in Switzerland. Their number remains undisclosed. That uncertainty leaves Swiss customers without a clear picture of their exposure, including whether they should expect direct contact, account monitoring or other protective measures from Revolut.

The incident places an international fintech provider under immediate scrutiny in Switzerland. Revolut serves customers across borders, while its local regulatory ambitions are moving forward. For users, the breach raises practical concerns about how a digital bank verifies official requests and communicates after a data security failure.

The breach began with a deception aimed at Revolut's own verification process. The criminals posed as an Italian law enforcement agency and applied pressure for the bank to disclose account details. Their success shows how a convincing authority request can become a route into sensitive financial information, even when the target is an established banking platform.

The available account of the incident does not say which individual or group carried out the attack. It also does not explain how the fraudsters built their impersonation, which checks Revolut completed, or whether the request passed through an internal escalation process. Those details will matter for customers and regulators assessing whether the failure resulted from one manipulated exchange or a wider weakness in procedures.

The ransom demand followed the disclosure. By publishing the demand online, the attackers have created a second pressure point for the bank: deciding how to respond while protecting affected customers and limiting further distribution of the data.

Revolut has not publicly disclosed its response in the source report. It has also not released a Swiss breakdown of the affected accounts. Those missing details will shape the next stage of the story.

The timing puts Revolut's Swiss expansion plans under a sharper spotlight. The company has applied for a Swiss banking licence, as it seeks a more formal presence in the market. The data breach arrives while the firm is trying to strengthen its position among Swiss customers, making operational safeguards part of the public debate around its application.

A Swiss licence would place Revolut's local banking ambitions in a more demanding regulatory context. The incident alone does not establish whether the company failed to meet any Swiss legal requirement, and the available report does not describe the status of the application. It does, however, give regulators and consumers a concrete case to examine: how a provider authenticates requests from foreign authorities and how quickly it informs people when information has been exposed.

The cross-border element is significant. The alleged officials were Italian, the bank operates internationally, and some affected customers live in Switzerland. That combination can complicate communication, investigations and responsibility, particularly when account holders use a service headquartered outside the country.

Swiss customers will need clear information about the affected data, the accounts involved and the protective steps available to them. Revolut has not provided those details in the source report.

Large banks invest heavily in cybersecurity, yet no institution can treat impersonation risk as a solved problem. The source report notes that major banks in Switzerland and abroad generally spend substantial sums on advanced security infrastructure. Criminals are also becoming more sophisticated and increasingly capable of bypassing safeguards.

For Swiss consumers, the immediate issue is visibility. The report does not state how many local customers were affected, what data the criminals obtained, or whether accounts and balances were directly accessed. Those distinctions matter. Stolen personal details can support later phishing attempts even when an attacker does not move money from an account.

Customers should treat unexpected messages claiming to come from Revolut, a police service or another authority with caution. They should use official support channels, avoid sending passwords or security codes, and monitor their accounts for unusual activity. These are general precautions, not evidence that every Swiss customer was compromised.

The incident also gives Revolut a clear set of issues to address as its Swiss application proceeds. Customers and regulators will expect an explanation of the verification failure, a precise account of the affected population and timely guidance for people whose information was disclosed. Until those details emerge, the scale of the Swiss impact remains open.