Key facts
- Revolut confirmed a data breach occurred after an unauthorized third party used a legitimate government agency email domain to submit fraudulent requests for customer information.
- The exposed data includes identity and contact details, birth dates, postal and email addresses, phone numbers, and copies of identity documents.
- Potentially exposed data also includes verification selfies, account statements, and transaction histories.
- Italian authorities are investigating the breach, which is linked to a compromised government email account.
- Revolut stated its systems and customer funds remain unaffected and that it has alerted relevant authorities.
- The incident targeted a limited number of customers, according to Revolut.
British fintech Revolut has confirmed a data breach occurred after an unauthorized third party used a legitimate government agency email domain to submit fraudulent requests for sensitive customer information. The exposed data includes identity and contact details, such as birth dates, postal and email addresses, and phone numbers, as well as copies of identity documents like passports and driver's licenses. The firm also indicated that verification selfies, account statements, and transaction histories may have been compromised.
Revolut stated that a "limited" number of customers were impacted and that the company has directly contacted those affected. The company blocked the email address upon discovering the scam and alerted the relevant government agency, law enforcement, and regulators. Revolut emphasized that its systems and customer funds remain unaffected.
Italian authorities, including the Polizia Postale (cybercrime police), are investigating the incident for unauthorized access and computer fraud. Some reports identified the compromised account as belonging to the Prefecture of Reggio Calabria, but the agency has denied sending such requests. Revolut declined to name the specific government agency involved due to the ongoing investigation.
The compromised government email account was reportedly part of Italy’s Posta Elettronica Certificata (PEC) system, a service that provides electronic messages with the legal standing of registered mail. However, Italy's CERT-AGID cybersecurity agency had previously warned about the potential for abused or illicit PEC accounts, noting it had handled over 650 such cases since the start of 2026.