Revolut confirms customer data breach caused by fake requests impersonating a government body

British fintech company Revolut has confirmed that it disclosed confidential customer information to an unauthorized third party. The data was handed over after the company received fraudulent requests sent from an email address on a legitimate government-agency domain.

What exactly leaked

According to a notice sent to affected customers and reviewed by TechCrunch, the attackers obtained identifying and contact details: date of birth, postal and email addresses, phone numbers, and copies of identity documents — passports and driver's licenses. The company acknowledges that the disclosed data may also have included verification selfies, account statements, and transaction histories.

A Revolut spokesperson told TechCrunch that a “limited” number of customers were affected and that the company had contacted them directly. However, the exact number of affected individuals has not been disclosed; Revolut also did not clarify whether the incident was confined to any single market, and declined to reveal which government body the fraudsters had impersonated.

The company's response

Revolut described the incident as a “sophisticated external impersonation scheme”: an unauthorized party used a legitimate government-agency domain to submit fraudulent requests for information. Once the scheme was discovered, the address was blocked, and the relevant agency, law enforcement, and regulators were notified. The company stresses that its systems and customer funds were not affected.

The breach was first publicly flagged by prominent crypto-security researcher ZachXBT, who posted about the Revolut email on Friday evening. According to him, the attack appears to have been aimed at wealthy customers.

Context

London-headquartered Revolut serves more than 80 million customers worldwide and operates as a bank in more than 30 countries, having recently expanded into India, Mexico, France, and the UAE. In early September the U.S. Office of the Comptroller of the Currency (OCC) granted the company conditional approval to establish a national bank in the United States; the launch is expected in the first half of 2027.

The incident coincided with reports of a possible Revolut IPO, at a valuation that could reach $200 billion, up from $75 billion at a private placement last November.

Source: TechCrunch