revolut didn't get hacked. someone asked politely, and they said yes. what happened: a request for customer information arrived from an unauthorised email account — sent through a real government agency's email domain. it carried valid domain authentication. revolut treated it as a genuine government request and fulfilled it. what they handed over, per the notices sent to affected customers: – full name, date of birth, occupation – postal address, email, phone number – a copy of your passport or driver's licence – the selfie you submitted for identity verification – account statements, iban, wallet reference number – withdrawal records and full transaction history, including bitcoin that isn't a leaked email list. that's a complete identity kit. and this attack wasn't new. in november 2024 the fbi warned that criminals were using compromised government email accounts to send fake emergency requests for customer data. the same advisory described one sent to paypal. paypal rejected it. now the part that makes it worse. the attackers are reportedly demanding 10,000 btc. they've already started publishing data belonging to high-profile clients, and say they'll release more every single day until revolut pays. they're accusing the company of negligence and of sharing customer information outside its jurisdiction. revolut says its systems and customer funds were unaffected, that a limited number of customers were involved, that it blocked the address and notified authorities. it hasn't said how many people were affected, or which agency's domain was used. here's the uncomfortable truth. you can use a strong password. protect your phone. never click a suspicious link. none of that decides what happens when someone emails your bank and asks for your file. and once those records leave, you can't change your passport like a password.