Revolut Data Breach Exposes Customer Records to Fake Requests

Revolut has disclosed that an unauthorized third party obtained sensitive customer information by impersonating a government agency and submitting fraudulent data requests. The breach, which the company says affected a "limited" number of users, exposed personal identity documents, account statements, and detailed Bitcoin transaction histories [1, 3].

How the breach occurred

The incident did not involve a technical compromise of Revolut’s internal systems or a software vulnerability. Instead, attackers utilized a legitimate government agency’s email domain—complete with valid domain authentication credentials—to submit requests that appeared to be lawful demands for information [3]. Revolut’s compliance team, treating the requests as genuine, fulfilled them by releasing a bundle of files that included customer passports, driver’s licenses, verification selfies, and full account histories [2].

While the company has not disclosed the exact number of individuals impacted, the nature of the data suggests a targeted effort. Security researcher ZachXBT noted that the incident appears to have focused on high-net-worth accounts [1]. The exposed information provides a comprehensive profile for potential phishing attacks, as it includes specific Bitcoin withdrawal records, wallet reference numbers, and personal contact details [2, 3]. Revolut stated that it has since blocked the fraudulent email address and alerted law enforcement and relevant regulators [1].

Operational and market context

Revolut, a London-based fintech with over 80 million global customers, is currently in a period of significant expansion [1]. The firm recently secured banking licenses in France and the UK and received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank, which is expected to launch in the first half of 2027 [1]. This security incident coincides with reports that the company is weighing a public listing that could value the firm at as much as $200 billion, a substantial increase from its $75 billion private valuation in November [1].

Despite the breach, Revolut maintains that its core systems and customer funds remain secure [1]. The company has not confirmed whether the incident was limited to a specific geographic market or identified the government agency whose domain was spoofed [1]. Because the firm is notifying affected customers individually rather than issuing a broad public disclosure, the total scale of the data exposure remains unclear [2].

What to watch

• Public disclosure: Whether Revolut releases a full recap detailing the number of affected accounts, the specific timeframe of the fraudulent requests, and the internal approval processes that allowed the data release.
• Phishing activity: Any uptick in sophisticated, personalized phishing attempts targeting Revolut users that reference specific account details, such as past Bitcoin transactions or IBANs.
• Regulatory response: Potential inquiries from regulators in the more than 30 countries where Revolut operates as a bank regarding the firm’s verification protocols for legal data requests.

The incident highlights the persistent vulnerability of human-led compliance processes when faced with sophisticated, domain-authenticated impersonation. With the firm preparing for a potential public listing, the effectiveness of its internal controls and its ability to secure sensitive client data will likely remain a focal point for both regulators and prospective investors.