Key facts
- Revolut disclosed sensitive customer data, including passport copies and Bitcoin transaction histories, to an unauthorized third party.
- The breach occurred after a scammer used a legitimate government agency email domain to submit fraudulent requests.
- Exposed data includes identity details, contact information, and document verification data.
- Bitcoin transaction histories and account statements were among the compromised financial data.
- Revolut confirmed a limited number of customers were affected and has contacted them.
- The company stated its systems and customer funds were unaffected.
Fintech giant Revolut has confirmed a data breach where sensitive customer information was disclosed to an unauthorized third party after a scammer successfully impersonated a government agency. The fraudulent request, sent from an email account using the agency's official domain and carrying valid authentication credentials, led Revolut to believe it was genuine.
The exposed data was extensive, including full names, dates of birth, occupations, postal and email addresses, and phone numbers. Crucially, copies of identity documents such as passports or driver's licenses, verification selfies, account statements with IBAN and wallet reference numbers, withdrawal records, and full Bitcoin transaction histories were also compromised. Revolut stated that no biometric facial telemetry data was involved.
A Revolut spokesperson described the incident as a "sophisticated external impersonation scam" and confirmed that a "limited" number of customers were affected. The company has since blocked the fraudulent email address, alerted the relevant government agency, law enforcement, and regulators, and assured that its internal systems and customer funds remain unaffected. Revolut declined to specify the number of impacted individuals or the identity of the impersonated agency.
Crypto security researcher ZachXBT highlighted the incident, suggesting it may have targeted high-net-worth users and raising concerns about "wrench attacks" amid a rise in similar data leaks. The breach occurs as Revolut is reportedly considering a public listing.