Swiss Revolut customers targeted in account-data breach

Nearly 700 Revolut customers had their account details handed to criminals after hackers convinced the digital bank that they were Italian law enforcement officers. Swiss-based clients are among those affected, although Revolut has not said how many customers in Switzerland were caught up in the incident.

The attackers reportedly used the false authority of an investigation to pressure the bank into releasing information. After receiving the data, they published a ransom demand online and asked Revolut for $3 million in exchange for keeping the customer records private.

The incident places Swiss users in a difficult position. The available information does not establish that funds were withdrawn from affected accounts, nor does it identify the exact information disclosed. Account data can still give criminals material for targeted phishing, impersonation and attempted account takeovers.

Revolut’s response to the ransom demand was not known when the incident was reported. The bank has also not stated whether Swiss authorities or affected customers have been directly notified. Those details will determine how exposed Swiss users may be and what protective steps they should take.

The attackers did not need to break through Revolut’s core systems to obtain the data described in the report. They reportedly exploited a trust process instead, posing as an Italian law enforcement agency and requesting information under the cover of an investigation.

That tactic is a form of social engineering. Criminals imitate institutions that banks must take seriously, then create urgency around a request for customer information. The pressure can be especially effective when a request appears to involve cross-border law enforcement and an active case.

The report does not identify the criminals, name the supposed Italian agency or explain which internal controls failed. It also does not specify whether the request was made through email, a legal portal or another communication channel. Those facts matter because banks typically rely on verification procedures before disclosing customer records.

For Revolut customers, the immediate risk may extend beyond the data itself. Criminals with information about an account holder can craft convincing messages that appear to come from a bank, police authority or financial regulator. Customers should treat unexpected requests for codes, transfers or identity documents as suspicious and contact Revolut through its official application.

The breach arrives as Revolut seeks a larger role in Switzerland. The digital bank has applied for a Swiss banking licence and is looking to expand its presence in the market, according to the supplied report.

That timing increases the scrutiny around the company’s handling of customer information. A Swiss banking licence would place Revolut within a more demanding domestic regulatory framework, with expectations covering governance, risk management, operational resilience and the protection of customer assets and data. The licensing process itself does not guarantee that every future cyber incident will be prevented.

The reported disclosure also highlights a challenge for fast-growing digital banks. Their services depend on rapid digital communication, automated workflows and cross-border operations. Those systems can improve speed for customers, while creating more channels that criminals may try to manipulate.

The case raises practical questions for Swiss regulators and consumers. Authorities will want to know how Revolut authenticated the request, which safeguards applied before disclosure and whether affected customers received timely warnings. Customers will also be watching for a clear account of what data was exposed and what compensation or support may follow.