Revolut customer data exposed after fraudulent government‑domain request

Revolut disclosed that an unauthorized third party obtained sensitive customer information by submitting fraudulent record requests that appeared to come from a legitimate government agency email domain. The fintech firm described the episode as a “sophisticated external impersonation scam” and said it blocked the offending email address once identified.

Scope of the breach

The company confirmed that a limited number of customers were affected and that it has contacted them directly. A notification sent to affected users indicated that the data shared may have included:

• Names, dates of birth, postal and email addresses, telephone numbers
• Copies of identity documents such as passports and driver’s licences
• Verification selfies, account statements, IBANs, withdrawal records
• Full transaction histories, including Bitcoin transaction details

Revolut declined to disclose the exact number of impacted customers, the geographic focus of the incident, or the specific government domain used in the fraudulent request.

Response and notifications

Revolut reported that its systems and customer funds remain unaffected. The firm alerted the relevant government agency, law‑enforcement, data‑protection authorities and financial regulators about the incident.

Context and speculation

Onchain investigator ZachXBT suggested the breach may have been aimed at high‑net‑worth Revolut users, noting that the incident appears limited in size but targeted.

Broader security landscape

The breach follows a series of recent data exposures affecting crypto‑related fintech firms, including:

• SafePal’s order‑tracking flaw that exposed personal details of roughly 39,800 customers.
• Trezor’s breach of a shipping provider affecting about 67,000 U.S. customers and a separate email‑provider breach that enabled phishing from a legitimate domain.

Revolut’s ongoing crypto expansion

Despite the incident, Revolut continues to expand its banking and crypto services. Recent developments include:

• Conditional approval from the U.S. Office of the Comptroller of the Currency to pursue a national banking charter.
• Rollout of EURR, a euro‑backed stablecoin, to customers in Denmark, Poland and Portugal.
• Integration of third‑party AI assistants into Revolut X, its standalone crypto trading platform.