Google Cloud’s London outage disrupted Revolut payments and ATM withdrawals, while ING Germany reported online banking issues.
Multiple Google Cloud services went offline in the London region this morning, according to Google’s status page, and the disruption didn’t stay contained to infrastructure dashboards.
BREAKING: Revolut's app and cards have stopped working across Europe.
Google Cloud's London region is affected by network failures. Revolut, and many other services, runs on Google Cloud.
British digital bank Revolut reported a widespread service outage at roughly the same time, and a person familiar with the matter told Reuters the two events were directly connected.
“Multiple Google Cloud services experienced disruptions in the company’s London region on Tuesday, according to its service status page, while British digital bank Revolut also reported a service outage.” Reuters states, “A person familiar with the matter told Reuters that Revolut’s service outage was related to the Google Cloud service disruption.”
The outage affected Google’s europe-west2 data center, its main facility in London. Google’s engineering team said they were investigating the problem. Alphabet did not immediately respond to Reuters’ request for more information. This is common during an ongoing incident, but it leaves customers unsure when their cards will work again.
Revolut’s own status page showed most services as unavailable or partially unavailable, including card payments and ATM withdrawals. For a bank that exists entirely as an app with no physical branches to fall back on, that’s not a minor inconvenience.
“We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience.” the financial company wrote on X.
We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience…
That last sentence is the right thing to say, and it’s also exactly what every bank says during an outage regardless of whether the underlying cause is confirmed. Money and data being safe is a different question from whether you can pay for your coffee.
ING Germany also reported problems on Tuesday. Customers had trouble logging into online banking and the mobile app because of a technical issue. Reuters did not link these problems to the Google Cloud outage, and ING has not explained the cause. Two major financial services companies experiencing problems on the same morning could be a coincidence. However, it also raises questions about how much European banks depend on a small number of cloud providers.
Google Cloud’s europe-west2 region in London supports many UK and European fintech services. Revolut alone serves tens of millions of customers across Europe. When a major data center goes down, the impact can quickly reach customers, preventing them from paying or accessing banking services before the cause is fully understood.
Your name, address, and phone number may already be for sale.
Data brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way.
Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach.
Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of information about customers:
Identity and contact information such as dates of birth, postal addresses, email addresses, and phone numbers
Copies of IDs such as passports and driver’s licenses
Verification selfies
Account statements and transaction histories
Revolut has said only that a “limited” or “very limited” number of customers were affected, and that it contacted them directly.
One affected customer received a phishing text on Monday, September 14, two days after Revolut publicly acknowledged the data breach. The message appeared in the same conversation as other Revolut texts, making it look as though it had come from the bank.
Phishing text to a Revolut customer
According to VirusTotal, the phishing domain was first scanned that same day.
In a separate example, another customer said that opening the link took them to a web page that requested access to their device’s camera. If you tap Allow, the page reportedly imitates Revolut’s live-video “turn your head” identity check before prompting you to enter a password.
This makes the phishing page appear more authentic. It may also allow the scammers to collect a selfie or video that could be used for further social engineering, identity fraud, or to make subsequent scams more convincing.
A convincing fake liveness check followed by a password screen is a common way to lower suspicion and obtain the information attackers need to attempt a real login or account-recovery flow.
If the campaign is connected to the breach, the information obtained from Revolut, combined with login details entered by victims or their approval of a login request, could be enough to take over their accounts.
How to stay safe
We don’t yet know whether the phishing campaign is using data exposed in the breach or whether unrelated scammers are exploiting news of the incident to target Revolut customers more broadly.
Either way, treat unexpected messages about your account with caution:
Don’t follow links in unsolicited messages. If a message concerns your account, open the official Revolut app directly.
Check the actual domain in your browser’s address bar to see if it corresponds with what you expect.
Use an up-to-date, real-time anti-malware solution on your device, preferably with a web protection component.
Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers.
The Revolut data exposure may be part of a much broader cyber incident involving compromised Italian government infrastructure.
Revolut has confirmed that its systems were not breached. Instead, the company received fraudulent requests that appeared to originate from a legitimate Italian government domain. The attackers allegedly abused an authentic institutional communication channel to obtain sensitive information on Revolut customers.
According to information reported so far, the compromised account was allegedly associated with the Prefecture of Reggio Calabria and used the pec.interno.it domain. The mailbox was reportedly abused by individuals posing as Italian Postal Police officers.
Databreach @Revolut Per quale ragioni un dipartimento Enti Locali di una provincia italiana dovrebbe chiedere informazioni finanziarie su clienti sparsi per mezzo mondo? A proposito: sono state inoltrate richieste per clienti Revolut italiani? pic.twitter.com/oTRKDLlkvA
The incident raises an important question: was Revolut deceived, or was the real security failure inside the Italian government infrastructure used to establish the attackers’ identity?
The Financial Times reported that approximately 680 Revolut customers were affected. The information reportedly obtained by the attackers included identity documents, addresses, banking information, account statements, verification selfies and transaction histories, including cryptocurrency transactions.
The attackers allegedly sent Revolut transaction identifiers and blockchain deposit addresses and requested information linking those transactions to specific customers.
Researcher Korra of Duel described the operation as a form of “spray and pray.” According to the analysis, the attackers submitted large numbers of transaction IDs and deposit addresses believed to be associated with high-value Revolut accounts and used fraudulent European Investigation Orders to request customer information.
BREAKING: Duel can report that the Revolut hacker used a "spray and pray" strategy, sending hundreds of cryptocurrency transaction IDs to Revolut and asking for the associated account details. Revolut complied.
The operation appears to have relied heavily on the trust associated with official government communications.
The most concerning element of the case may not be the data obtained from Revolut, but the alleged compromise of Italian law-enforcement infrastructure behind the requests.
The threat actor IAmNotAVillain, which claims responsibility for the operation, alleges that it maintained access for approximately six months to systems belonging to several Italian law-enforcement departments.
The group further claims to have exfiltrated approximately 147 GB of data, allegedly including internal documents, emails, calendars and personal information.
This claim has not been independently verified and should therefore be treated separately from the elements of the Revolut incident that have already been confirmed.
But if the 147 GB dataset exists, its origin could fundamentally change the assessment of the incident.
As researcher @sonoclaudio, who supported my investigation, noted, there is a major difference between compromising a single PEC mailbox and allegedly extracting 147 GB of information from Italian institutional systems.
The first would provide attackers with a powerful tool for impersonation.
The second would indicate a potentially much broader compromise of government infrastructure.
Investigators therefore need to establish where the alleged data originated, which systems were accessed, when the compromise occurred and what information was extracted.
The answers could reveal whether the Revolut operation was an isolated abuse of a government mailbox or part of a longer intrusion into Italian institutional networks.
A second PEC account raises more questions
Another detail could be particularly relevant.
The fraudulent communication sent to Revolut allegedly included a second institutional PEC address in copy.
Poi, come fa notare @forensico, c'è un secondo soggetto a conoscenza di tutto (…..@pec.interno.it): possibile che non abbia notato nessuna anomalia? pic.twitter.com/e31lUwkOmT
That detail could have made the request appear more credible. A message originating from an official government address and simultaneously copied to another public administration mailbox can look like a normal exchange between government offices.
But it also raises an obvious investigative question: was the second mailbox compromised as well, or was it simply used as a recipient to reinforce the credibility of the request?
Answering this will require access to the original email headers, PEC logs and authentication records associated with the affected accounts.
Those technical records could help determine whether the messages were actually sent through the legitimate infrastructure, whether the accounts had been taken over and whether other government mailboxes were involved.
The incident highlights a fundamental problem in identity security. An email can be technically authentic and still be fraudulent in a broader sense.
If an attacker controls a legitimate government mailbox, the message may pass technical checks designed to establish its origin. But those controls do not necessarily establish that the individual operating the account is authorized to issue the request.
This distinction between authentication, identity and authorization is critical.
For organizations such as financial institutions, verifying the domain or email infrastructure of a government requester may no longer be sufficient. Requests involving large amounts of sensitive customer information should also be evaluated against additional signals, including the authority of the requester, the legal basis of the request, the scope of the information requested and unusual behavioral patterns.
In the Revolut case, repeated requests involving large numbers of cryptocurrency transactions could potentially have provided additional indicators that warranted closer scrutiny.
How were the Italian accounts compromised?
Another major unanswered question concerns the initial access.
Some reports have referred to infostealers and compromised accounts, but publicly available information is not yet sufficient to establish how the attackers obtained access to the Italian PEC accounts.
It is also unclear whether multifactor authentication was enabled on the affected accounts and whether attackers obtained valid credentials, session tokens or other authentication material.
These details matter because they could determine whether the incident resulted from credential theft, endpoint compromise, weak authentication controls or another attack vector.
The alleged 147 GB dataset should therefore not be presented as an established fact at this stage.
It remains a claim made by the attackers.
But it is a claim that investigators cannot afford to ignore.
If confirmed, the central issue would no longer be limited to the exposure of Revolut customers. Investigators would need to determine whether sensitive Italian government information was stolen before the Revolut operation, during it, or as part of a much broader intrusion.
That could include internal communications, operational information and potentially sensitive material related to law enforcement activities.
For now, the Revolut case demonstrates how a compromise inside one trusted organization can be leveraged to attack another without directly exploiting its infrastructure.
The attackers may not have needed to breach Revolut.
They allegedly compromised the trust surrounding an official government identity, and used that trust as the access mechanism to sensitive financial information.
That is what makes this case particularly significant.
The most important investigation may therefore not be inside Revolut. It may be inside the Italian government systems whose identity was allegedly abused.
Revolut has acknowledged that it disclosed sensitive customer records to an unauthorized party. The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain, according to TechCrunch.
Revolut is a London-based banking and financial platform with more than 80 million customers globally, according to the company.
Revolut describes this as an external impersonation scam, not an intrusion into its systems. It also says customer funds were not affected. Revolut has not identified the government agency or disclosed its email domain.
The attacker appears to have abused the trust attached to a real government email domain to make bogus requests for customer information. Revolut detected the activity, blocked the sending address, and says it notified the relevant agency, law enforcement, data protection authorities, and financial regulators.
“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators.”
Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of information about customers:
Identity and contact information like dates of birth, postal address, email address, and phone number.
Copies of IDs such as passports and driver’s licenses.
Verification selfies.
Account statements and transaction histories.
Revolut has said only that a “limited” or “very limited” number of customers were affected, and that it contacted them directly.
Those customers have received or will receive an email specifying which of their personal data was disclosed:
How to stay safe
The likely consumer impact will be second-stage fraud attempts rather than immediate unauthorized transfers. Here are some guidelines to help keep your money safe:
Treat any unexpected Revolut-related contact as suspicious, especially calls, emails, WhatsApp messages, or text messages claiming you need to “secure” an account, reverse a transfer, or replace documents. Do not use links or phone numbers supplied in the message. Revolut advises ending contact with suspected scammers and contacting the company through official channels.
IDs and other exposed information could be used for identity theft. Monitor your accounts and credit reports for unfamiliar account openings or credit applications, and consider placing a fraud alert or using credit monitoring where available in your country.
If you received a notification email, check your balances, cards, beneficiaries, recent transfers, account statements, and linked devices. Report any unfamiliar activity immediately through Revolut’s secure in-app chat.
Pro tip: Use Malwarebytes Scam Guard to analyze any suspicious communications. It can help you determine whether a message is a scam and advise you on what to do next.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.
Revolut handed over KYC documents, selfies, and Bitcoin transaction histories after a fake government email with valid domain credentials passed its checks.
Revolut confirmed on September 12, 2026, that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from an email address operating inside an actual government agency’s domain infrastructure. TechCrunch reported. The customer notification, which began circulating on September 11, stated that the communication carried valid domain authentication credentials, meaning the email passed the checks that are supposed to confirm a message genuinely comes from a government authority.
“Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency’s email domain.” reads the Revolut’s notification. “As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request.”
“The exposed data included customers’ identity and contact details, including their birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including passports and driver’s licenses, according to a notification emailed to affected customers and reviewed by TechCrunch.” reported TechCrunch. “The data may have also included verification selfies, account statements, and transaction histories, the firm said in its notification.”
Multiple outlets including CoinDesk and Crypto Times confirm the transaction histories covered Bitcoin. What Revolut handed over is essentially everything a regulated fintech is required to collect for identity verification, in one package, sent to the wrong people.
Below are the details of the handed-over data reported in the notification:
Identity details: full name, date of birth, occupation
Contact details: postal address, email address, and telephone number
Document and verification data: a copy of your identity document (passport and/or driver’s licence) and facial verification image (the selfie you provided for verification). Please note that no biometric facial telemetry data was involved or compromised
Financial data: account statements (including IBAN, account status, opening date, wallet reference number), withdrawal records and full transaction history (including Bitcoin)
This is not a technical breach in the usual sense. No systems were compromised, no malware was used, and Revolut’s servers were not accessed by an outsider. The attacker either created a rogue account within an official government agency’s domain or compromised an existing one, then used that account to submit what appeared to be a legitimate data request. Revolut staff processed it. The company only discovered the fraud afterward, by independently contacting the government agency to verify the request, at which point the agency confirmed it had not made it.
Revolut said that the incident impacted a limited number of customers and immediately contacted them, but did not disclose the scope of the incident.
Revolut also declined to name the government agency involved or specify whether the breach affected a particular country or market. Naming the agency would allow other regulated platforms to search their own legal-request logs for messages from the same mailbox. The silence on that point is a gap in the public record that matters for other fintechs who may have received similar requests.
Crypto security researcher ZachXBT, who posted about Revolut’s notification to affected customers, assessed that the incident appeared to be targeted at high-net-worth users.
If this assessment is correct, this was not a large-scale data theft. It appears to have been a targeted operation aimed at building detailed profiles of wealthy individuals, using their KYC documents and cryptocurrency transaction history linked to their real identities. Combined with IBANs and account statements, this information could be very useful for fraud, impersonation, or extortion.
Revolut says it blocked the email address, alerted the government agency involved, notified law enforcement, and reported the incident to financial regulators. Revolut also says its systems and customer funds were not affected. That may be technically true, but it misses the main point: the attackers did not need to hack Revolut’s systems to get the data.
The breach comes as Revolut seeks greater regulatory credibility, TechCrunch argued. The company recently won conditional U.S. approval to become a national bank, is reportedly considering a $200 billion IPO, and serves 80 million customers worldwide. The incident also highlights weaknesses in fintech data-request processes: relying mainly on email authentication can allow attackers with access to a government domain to bypass checks and obtain sensitive customer data.
Entrar
BREAKING: Revolut's app and cards have stopped working across Europe.
