Revolut数据泄露：银行为680名客户支付新身份证件费用，以及你现在可以采取的措施

Revolut promises to bear the costs of replacing customers 'identity documents due to data breaches: Progress as of October 7

Béatrice Cossa-Dumurgier, head of Western Europe at Revolut, announced in an interview with French BFM TV on October 7, 2026 that if customers need to re-apply for identity documents due to data theft, the bank will bear the relevant costs. Reuters reported the promise on the same day. The leak affected 680 customer accounts. Cossa-Dumurgier did not disclose the total cost estimate or say whether any customers had changed their credentials.

For customers who hold and are affected by cryptocurrency, in addition to the ID replacement fee, there is another serious issue that has nothing to do with the fee. According to reports, the data flowing out of banks included copies of identification documents, address data and account statements. This is the key data set that service providers need when rebuilding users 'identities. This article puts this commitment in the background, lists confirmed data facts, and combs the current opening-up response steps in the European region.

Specific content and limitations of the commitment

According to Reuters reports, Cossa-Dumurgier said that if affected customers need to change their identity documents in the future, Revolut will bear the associated costs incurred thereby. However, the statement did not include a specific application process, deadline or compensation cap. Any customer wishing to take advantage of this commitment should contact the bank's support team and obtain written confirmation, as verbal commitments in television interviews do not constitute a public reimbursement policy.

In the same interview, the head of Western Europe drew two boundaries: one is that the bank's own systems have not been breached; and the other is that Revolut will not pay ransom. She pointed out that public authorities are sometimes weak links in the security chain to explain how data flows out of banks. As the agency report stated, the commitment did not mention how many of the 680 affected customers lived in Germany.

Losses outside the scope of fee coverage

In this case, the cost of a new document is only the smallest part of the loss. Changing ID cards does not eliminate the fact that birth dates, addresses, occupations and financial flow records have fallen into the hands of third parties; these details will not change with the issuance of new chip cards. As a result, customers who only received reimbursement for expenses only addressed the portion of the damage that could be measured in euros.

680 affected accounts and five-month access period: The timeline of the data breach

The case occurred much earlier than the extortion request was made. According to SecurityWeek's analysis, the attacker's access lasted for five months, involving 680 accounts, and the extortion amount was approximately $3 million. Reuters reported that 55 of the 680 affected customers live in France; Revolut is understood to have provided assistance to all 680 customers.

The incident became public in September 2026, when the hacker group set a deadline and threatened to sell data. We reported on this stage at the time, including the question of how to confirm our own affected status: "Revolut Data Breach: Am I Affected? What about my Bitcoin history?"

The commitment to ID card fees is the first step taken by banks, going beyond mere information disclosure and truly involving monetary expenditures.

The number of 680 is the bottom line, not the final count.

SecurityWeek lists 680 accounts as high-value target accounts. Whether this number is accurate remains to be seen after the review is complete; since access lasts for five months, the final count depends on which disclosures are subsequently determined to be unauthorized. Therefore, the actual number may be higher, but this has not been confirmed by existing sources.

Hijacked government mailbox as entry point: How attackers obtain data

According to Revolut, the bank provided customer data to an unauthorized party after receiving an information request from an email address with a public authority domain name. Reported that the attacker controlled an Italian authority's email system to achieve this goal. Technically speaking, this is not an intrusion into the banking system, but an abuse of the procedures that banks must daily serve law enforcement agencies.

The Italian Interior Minister criticized Revolut, arguing that the bank should have verified more carefully whether the request had indeed come from the Italian government. This is his view, not our judgment; whether it constitutes dereliction of duty will be decided by regulators and courts, not by the editorial department.

Why is this attack route difficult to defend against

来自执法机构的信息请求本质上来自外部，具有紧急性，且不能让客户察觉。这三个特点恰恰剥夺了银行通常的反向检查机制：询问客户是被排除的，只要当局自己的邮箱处于他人控制之下，发件人域名看起来就是真实的。验证的第二渠道（例如拨打独立获取的官方号码）是此类攻击失败的关键点。

从护照到验证自拍：被盗取的数据字段

报道描述的数据集远超姓名和账号范围。它包括全名、出生日期、职业、地址和联系方式，以及护照和驾照、账户对账单、面部验证图像和交易历史。综合来看，这是一份完整的身份档案，附带金融画像。

据称，Revolut是在响应来自被劫持政府地址的请求后释放了这些数据。银行卡号可以在几天内冻结并替换，但出生日期无法更改，地址只有在搬家后才能变更，而面部图像则完全无法更改。这正是此次事件与普通卡欺诈的真正区别：泄露的数据字段在多年内仍可使用。

为何KYC数据集比卡号更具权重

在银行或加密交易所开设账户需要通过身份检查，而同一检查机制也作为许多服务在用户丢失访问权限时的应急出口。这一机制解释了后续的风险：

• 建立可信度：A caller who knows his date of birth, address, occupation and recent financial movements does not sound like a fraud, but like the case handler he claims to be. Account statements provide details that are not normally available to outsiders.
• Get access: In many services, ID pictures and selfies are proof of recovering lost access. If both are in the hands of a third party, the security of the account depends on whether the provider additionally requires factors that are not included in the data set, such as hardware keys or applications on a particular device. SMS confirmations are ineffective because people with a complete ID can transfer their phone numbers to their devices.
• Risks outside the network: Recorded home addresses, combined with recorded wealth levels, form a prerequisite for what the industry calls a "wrench attack"(i.e., physical coercion rather than technical detour). The hacker group claims to have selected customers who hold large amounts of cryptocurrency through blockchain analysis; although this choice is not confirmed by documentation and comes only from the perpetrators themselves, this explains why the dataset is seen in the crypto community as a distinct risk from address buying and selling.

6,000 Monero as ransom: equivalent at current price

The group calling itself "iamnotavillain" demanded payment of 6,000 Monero coins and set a 24-hour deadline, according to the Financial Times. At the time of the request, this was equivalent to approximately $3 million. On October 10, 2026, the trading price of Monero was US$527.46; based on this price, 6,000 XMR was approximately US$3.16 million. As a result, although the attackers did not change anything, the amount of extortion denominated in dollars increased slightly.

The choice of currency is itself part of the threat. Monero hides amounts and participants in its agreement itself, so it lacks the payment trajectory that makes Bitcoin investigations possible. According to Reuters, Revolut said it would not pay ransom, but also said it had no direct contact with the responsible group and had not received any requests from it. These two statements coexist, but the source does not resolve the contradiction.

Data was stolen, not balances were transferred

According to reports and Revolut, no funds left the bank. The loss lies in identity and account information, not empty accounts. This distinction is crucial to locating cases: Financial losses can only arise later where the data triggered a secondary attack.

German ID fee of 46 euros: The fee covers what is actually purchased

From February 7, 2026, the German ID card fee for applicants aged 24 and above is 46 euros, compared with 37 euros previously; the Bundesrat approved the price increase on January 30, 2026, and the municipal authorities have since announced it. For applicants under the age of 24 who are valid for six years, the fee is 27.60 euros. The fee for a temporary ID card is 10 euros, plus an additional 15 euros if mailed directly to your home.

Since the passport amount given in the quoted source still uses the old ID card price of 37 euros, the price increase is earlier than this time, and the passport fee in 2026 cannot be calculated based on this. People who want to change their passports should consult the responsible local registry office about fees rather than relying on estimates in the guide. For Revolut's reimbursement, what matters is the charge notice issued by the office, not the estimated amount.

Replacing ID can only solve half of the problem

A new ID card comes with a new ID number, and the old number will be invalid. This eliminates abusive parts that rely on valid numbers, such as new registrations that require document checking. In contrast, facial images for verification are still available, and the address can continue to be used as long as the address is still correct.

Identity theft after KYC breach: Detailed attack path

Multiple attacks can be built based on this dataset, with the difference being what additional things the perpetrator needs.

Telephone fraud with inside knowledge

呼叫者冒充银行、交易所或公共当局的员工，并利用账户对账单中的细节来证明其角色。目的是获取授权、代码或将资金转移到所谓的安全账户。没有任何银行或加密交易所会通过电话索要恢复代码或钱包备份助记词；这条规则是终止此类呼叫的红线。

恢复他人的访问权限

在许多服务中，身份证图片和自拍是找回丢失访问权限的证明。如果两者都在第三方手中，账户的安全性就取决于提供商是否额外要求数据集中不包含的因素，如硬件密钥或特定设备上的应用程序。短信确认无效，因为拥有完整身份文件的人可以将电话号码转移到自己的设备上。

通过家庭地址的路径

旁边有记录在案的加密货币持有的地址将风险从技术领域转移到家庭领域。有助于通过存储持仓来准备，以便单次转移不会导致全部损失，例如将用于日常使用的小余额与自我托管的大额余额分开。

GDPR第82条下的补偿：德国受影响客户的法律框架

《通用数据保护条例》（GDPR）第82条赋予每个人因违反条例的处理行为而遭受物质和非物质损害时获得赔偿的权利。第34条要求控制器通知那些面临高风险数据泄露的受影响者，第15条授予人们了解存储在身上的数据及其披露对象的权利。

但这并不意味着在Revolut案中一定发生了违规行为。这一评估属于 competent 监管机构，并在争议中由法院决定，关键在于信息请求的审查是否符合所需标准。作为受影响者，无论评估结果如何，您在第15条下的权利都是开放的，通过第15条的主题访问请求是将您自身的暴露情况记录在案的方式，而不是假设它存在。

管辖权与监管

Revolut在欧盟通过立陶宛银行牌照开展银行业务，并在其他成员国提供欧洲护照服务。受影响客户可以向其居住国的数据保护当局提出投诉，在德国则是向主管州当局提出；当局在程序期间相互协调。通过您所在的州当局进行投诉是更短的路径，因为它以您的语言工作且无需跨境元素。

使用硬件钱包进行自我托管：如何缩小攻击面

提供商的账户依赖于身份检查，而这正是本案的弱点。自我托管颠倒了这种关系：在那里，设备的占有权和备份知识决定访问权限，而别人手中的身份证图片对此毫无帮助。哪些设备是候选者以及它们有何不同，请参阅我们的加密硬件钱包比较。

这种做法有一个与此案相符的副作用。任何人持有自己的密钥都独自承担丢失的风险，此时备份助记词是唯一重要的东西。这些词语既不应放在照片中，也不应放在云存储中，因为像此处泄露的数据集所显示的那样，一旦信息以数字形式存在，其传播程度有多远。

持仓转移时的税务适用情况

在您自己的钱包之间的转账不属于处置，在德国不触发税收。重要的是文档： acquisition 日期必须保持可追溯，因为一年的持有期取决于它们。任何人如果没有记录地转移持仓，并没有失去期限本身，但失去了简单的证明。将持仓转移到自我托管时，应记录日期、金额和地址，以便一年期保持可证明；您自己钱包之间的转账仍然是免税的。

自九月文章以来的变化

九月，主要问题是您自己是否受到影响，以及公开发布的数据集意味着什么。此后有两件事发生了变化。首先，截至10月7日，银行做出了超越建议且涉及金钱的承诺。其次，SecurityWeek的分析记录了五个月的时期，这使得该事件表现为长期访问而非单一的错误披露。

仍有三点开放，对于德国客户结案来说是必要的：680名受影响客户中有多少居住在德国，报销通过何种途径运行，以及数据是否在最后期限过后被出售或发布。对于这些点， reviewed sources 均未提供答案。

我们的评估：费用覆盖是一个信号，而非补偿

在编辑团队看来，这一承诺是正确的，但力度太小。数字说明了情况：46欧元的身份证费用对抗的是一个包含出生日期、地址、职业、账户对账单和面部图像的数据集，其中只有证件号码可以通过更换文件更新。五个月的访问和680个账户也不是一个可以通过费用退款来解决的数量级。

另一方面，根据所有 reviewed sources 的说法，Revolut是某人政府邮箱遭受攻击的受害者，而非其自身系统被入侵的受害者。回答执法机构信息请求是银行履行义务；唯一的问题是它在这样做时如何进行严格的反向检查。标准是否足够由监管机构判断，在此之前，该承诺仍然是它现在的样子：一个涵盖费用并将其余部分留待解决的初步步骤。加密投资可能导致全部损失；本评估仅评判局势，既不推荐购买也不推荐卖出。

Revolut数据泄露：十年的有效期，十年的暴露期

German ID cards are valid for ten years and six years for applicants under the age of 24. As long as the documents are not replaced, the leaked copy can still be used as proof during that time. The next steps depend on this.

Establish in writing your exposure and begin reimbursement

Request information from the support department in accordance with Article 15 of the GDPR, confirm in writing the commitment to fee coverage in the same case, and retain the charge notice at the registry office. For daily balances on mobile phones, it's also worth looking at a comparison of cryptographic software wallets, because separating positions can limit the damage caused by any single leak.

Decoupling login information from SMS codes

At each exchange and broker, switch the secondary factor to the application or hardware key and review the recovery path because once someone has a complete identity file, the phone number is hackable. Which providers are regulated in Europe and what safeguards they offer, please see the overview of best regulated crypto exchanges.

Record the process of entering self-custody

Anyone withdrawing a position from an exchange should record the date, amount and address so that it remains provable for a one-year period; transfers between your own wallets will still be tax-free. Related tools can be found in the Overview of Crypto Tax Software and Combination Trackers.

(As of October 10, 2026. This article does not constitute investment advice. Price and fee structures will change; check terms with your provider before purchasing.)