Unverified 75M-Record Revolut Dataset Listed on Cybercrime Forum; Samples Contain Partial Card Data, Hashed Credentials, Device Metadata

A threat actor listed an alleged 75-million-record Revolut customer database on an underground forum on July 25 for $500 — a suspiciously low price — containing files labeled cards.csv, credentials.csv, devices.csv, users.csv, and accounts.csv with partial card details, hashed credentials, email addresses, phone numbers, and device information. Cybernews researchers confirmed sample data appears current through approximately May 2025, found no link to prior documented Revolut incidents, and suspect possible aggregation from multiple sources. Revolut denies any evidence of a new breach, but the combination of partial card metadata and PII in the sample creates a credible phishing and social-engineering threat surface for affected users regardless of provenance.

Cybernews researchers confirmed sample data appears current through approximately May 2025, found no link to prior documented Revolut incidents, and suspect possible aggregation from multiple sources.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.