Revolut Data Breach Exposes Customer Identity and Crypto Records

Revolut has confirmed that an external impersonation scam resulted in the unauthorized disclosure of sensitive customer data, including identity documents and Bitcoin transaction histories, after attackers successfully spoofed a legitimate government agency’s email domain [1, 2]. While the fintech firm maintains that its internal systems remain secure and no customer funds were accessed, the incident exposes a critical vulnerability in how financial institutions verify legal-compliance requests [2, 3].

Anatomy of the breach

The incident began when an unauthorized party, operating from an email address on a genuine government domain, submitted requests for customer information that passed standard domain authentication checks [2]. Revolut staff processed these as routine legal-compliance requests, inadvertently releasing data for approximately 680 customers [2]. The disclosed information includes full names, dates of birth, home addresses, phone numbers, and copies of passports or driving licenses [2].

Beyond basic contact details, the breach extended to financial and digital asset records. Affected files included account statements, IBANs, and full transaction histories, which reportedly contained specific records of Bitcoin activity [1, 2]. While Revolut noted that no biometric facial telemetry data was involved, the exposure of verification selfies and identity documents creates a heightened risk for targeted impersonation and social engineering [2].

Risks for crypto holders

The exposure of linked financial and identity data poses a specific threat to crypto users, as it bridges the gap between anonymous on-chain activity and real-world identities [2]. By connecting specific Bitcoin transaction histories to verified documents and residential addresses, the leaked data allows for the monitoring of future large transfers by individuals who already possess the user's personal information [2].

This incident follows a pattern of social engineering attacks against major platforms, including previous data leaks at Apple, Meta, and Discord, where attackers used forged emergency requests to obtain user information [2]. Although Revolut has blocked the fraudulent email address and notified law enforcement and financial regulators, reports on Telegram claim that a group is now leaking files purportedly belonging to VIP clients, allegedly demanding a ransom of 10,000 Bitcoin [1, 2]. Revolut has not confirmed the authenticity of these files or the ransom demand [2].

What to watch

• Official disclosures: Whether Revolut identifies the specific government agency impersonated or provides further clarity on the duration of the unauthorized access [2, 3].
• Data circulation: Monitoring for further releases of internal material or customer files on Telegram, which may indicate the scope of the attackers' holdings [1, 2].
• Verification protocols: Any changes to how the company validates incoming legal-compliance requests to ensure that domain authentication is no longer treated as sufficient proof of authorization [2].

The core issue remains the "seam" in institutional compliance: the legal obligation to respond to official requests creates a channel that, if compromised, allows attackers to bypass internal security systems entirely [2]. Whether this incident leads to a broader industry shift in how banks authenticate sensitive data requests remains the primary open question for the fintech sector [2, 3].