preferred on
Points of Focus
- Attackers obtained data on approximately 680 customers without breaching Revolut’s core systems, highlighting risks around legitimate information-disclosure processes.
- Unlike passwords, identity documents, biometrics, and other permanent personal information cannot easily be replaced once compromised.
- Selective disclosure and zero-knowledge proofs could reduce unnecessary data sharing, while FATF guidance suggests some flexibility in where identity evidence is retained.
Hackers stealing data from banking app Revolut via a compromised Italian government email account and reportedly demanding a $3-million ransom left affected customers facing an unusual security breach: Revolut’s systems themselves had not been hacked.
Fraudsters allegedly impersonated law enforcement officials and submitted information requests that appeared legitimate. Revolut disclosed customer data in response, according to reports, affecting approximately 680 customers across more than 30 European countries.
Revolut said its systems were not breached and customer funds remained secure.
‼️ BREAKING: We're in contact with the Revolut hacker. According to them, they didn't only take Revolut data, they've also compromised multiple Italian law enforcement departments.
They say the operation targeting Revolut ran for six months, and that they used Italian law… pic.twitter.com/ZYGWZEc0tL
— International Cyber Digest (@IntCyberDigest) September 14, 2026
That distinction makes the incident more revealing, not less.
Financial institutions collect passports, addresses, photographs, and other personal information because Know Your Customer (KYC) rules require them to establish who their customers are. But once that information is retained, institutions must protect it not only from hackers but also from attackers exploiting legitimate processes through which the data can be accessed.
The Revolut incident exposes a paradox in modern financial compliance: KYC reduces one category of financial risk while creating repositories of verified identities that criminals have strong incentives to obtain.
Identity data is different from a password
KYC became fundamental to modern finance as Anti-Money Laundering (AML) and counter-terrorist financing requirements expanded and financial services moved online.
Opening an account can now involve scanning a government-issued document, submitting a selfie, passing biometric or liveness checks, and having personal information screened against sanctions databases.
Those controls enable remote onboarding while meeting regulatory requirements. They also create unusually sensitive data sets.
The problem grows when that information is replicated. One customer may submit similar documents to a bank, crypto exchange, fintech platform, and other financial services, creating multiple places where versions of the same permanent identity information are processed or retained.
Once exposed, that data can remain useful for impersonation, phishing, and social engineering long after the original breach has been contained.
Attackers are getting better at passing the gate
Data theft is only one side of KYC’s security problem. Institutions must also determine whether someone presenting an identity is actually its owner.
Digital onboarding replaced employees examining physical documents with scans, database checks, and biometric verification. Generative AI is now making that task harder.
Entrust’s 2026 Identity Fraud Report, based on more than 1 billion identity-verification events across 195 countries and more than 30 industries, found that deepfakes accounted for one in five biometric fraud attempts. Deepfake selfie attempts increased 58% in a year, while injection attacks, which constitute manipulated images or videos fed directly into verification systems, rose 40%.
Synthetic identities can combine legitimate personal information with fabricated attributes, while AI-generated faces and manipulated videos challenge systems designed to determine whether a remote applicant is genuine.
Revolut exposes a different attack surface
The Revolut case demonstrates why better identity verification cannot solve the entire problem.
An institution can correctly verify customers and securely store their information, yet still face risk when that information legitimately needs to leave its systems.
Banks and fintechs must respond to law enforcement inquiries, regulatory requests, and court orders. Customer-service teams need account-recovery procedures, while external identity providers may process information during onboarding.
Each process creates another potential point for impersonation or manipulation.
In Revolut’s case, attackers reportedly targeted the mechanism for responding to official information requests rather than its core systems.
Crypto makes leaked identities more consequential
These risks have particular implications for cryptocurrency holders.
Traditional identity theft can lead to fraudulent accounts and unauthorized transactions. For crypto users, leaked information can potentially connect a person’s real identity and physical address with known or suspected digital wealth.
Crypto assets can also be transferred rapidly, and transactions can be difficult or impossible to reverse once an attacker gains control of an account or private keys.
That does not make KYC unnecessary. Regulated crypto platforms still need to identify customers, screen sanctioned parties, and monitor illicit-finance risks.
The more useful question is whether meeting those obligations always requires collecting and retaining as much underlying identity information as today’s systems often do.
Does proving identity require storing all the evidence?
Verification and retention are related, but they are not identical.
A financial institution may need to establish that a customer is an adult, resides in an eligible jurisdiction, or has passed identity checks. The conventional model often requires collecting the underlying information used to establish those facts.
Privacy-preserving identity proposes another approach: prove the required fact while revealing less of the evidence behind it.
For example, a service checking whether someone meets an age threshold may not need their exact date of birth, nationality, photograph, and passport number. A digital credential could potentially disclose only that the requirement has been satisfied.
A trusted credential issuer could similarly attest that someone’s identity has been verified without requiring every financial service to collect another copy of the same document.
Zero-knowledge proofs extend the concept by allowing one party to demonstrate that a statement is true without exposing all the information behind it.
How the idea is drawing attention from financial regulators
In a Sept. 23 speech at the Securities Industry and Financial Markets Association’s Digital Assets Conference in New York, the SEC Commissioner Hester Peirce argued that attribute-based credentials would enable financial institutions to verify facts such as a customer’s age, citizenship, accredited-investor status, or absence from sanctions lists without receiving the underlying personal information. A zero-knowledge proof, as she said, could confirm that someone meets a requirement without revealing their name, income, or address.
Peirce, speaking in her personal capacity rather than for the SEC, argued that regulation should move away from prescriptive data collection toward attribute-based verification where technologically feasible. She also questioned why multiple regulated companies should collect the same customer information when a trusted institution has already verified it.
This concern goes directly to the data-concentration problem of KYC: Repeated verification can leave copies of the sensitive identity information stored across numerous institutions, multiplying the number of places attackers can target.
The concept is moving beyond crypto theory. Europe’s digital identity framework is developing digital credentials and selective-disclosure mechanisms, providing another real-world test of whether users can prove attributes while revealing less personal information.
Regulation may leave room for a different model
Financial compliance, however, requires considerably more than proving someone’s age.
Banks, exchanges and fintechs face recordkeeping requirements and must respond to lawful information requests. Regulators may also need evidence showing how an institution established a customer’s identity.
But regulation may leave more architectural flexibility than assumed.
The Financial Action Task Force’s (FATF) digital-identity guidance says recordkeeping obligations still apply when digital ID is used. However, it notes that underlying identity evidence may be retained partly or entirely by a digital ID provider rather than duplicated by every regulated institution.
Records showing what evidence was checked, when, and from which source could also potentially satisfy some recordkeeping objectives, depending on national rules.
This does not eliminate the challenge.
KYC needs defenses beyond onboarding
Privacy-preserving credentials are unlikely to replace conventional identity systems overnight.
More immediate improvements include minimizing retained information where regulations permit, restricting and logging access to identity records, and independently authenticating purported government or law-enforcement requests.
Passing KYC should not mean an account is permanently trusted either.
Entrust’s 2026 data found account takeover particularly concentrated in digital banking, while 82% of payment-related fraud occurred around authentication rather than initial onboarding. This supports treating identity as a continuous security problem rather than a one-time KYC checkpoint.
From knowing everything to proving enough
The lesson from incidents such as Revolut’s isn’t that KYC has failed.
It is that verified identity information remains valuable after verification. Every database that stores it, the vendor that processes it, and the legitimate procedure through which it can be disclosed become part of the security perimeter.
Better authentication and access controls can make today’s model safer. Privacy-preserving credentials raise a more fundamental possibility: Institutions may not always need to possess all the underlying information simply because they need proof of a particular fact.
Financial compliance has traditionally focused on how confidently institutions can know their customers.
The next stage of digital identity raises another question: How little customer information can an institution hold while still proving that it knows them?
For KYC, collecting less data may eventually become as important as verifying it correctly.
Share
Most read articles
