Hassan Maishera
TL;DR
-
Revolut disclosed sensitive customer information after receiving fraudulent records requests from a legitimate government agency email domain.
-
Potentially exposed data included contact details, identity documents, verification selfies, IBANs, and complete transaction histories.
-
Revolut said only a limited number of customers were affected, while its systems and customer funds remained secure.
Revolut disclosed sensitive customer information to an unauthorized third party after receiving fraudulent records requests from a legitimate government agency email domain.
The British fintech company described the incident as a “sophisticated external impersonation scam.” Revolut said it blocked the relevant email address after detecting the fraud and stressed that its systems and customer funds were not compromised.
A limited number of customers were affected and have been contacted directly. However, Revolut declined to reveal the number of affected users, the government agency whose domain was exploited or whether the incident was limited to one market.
Identity Documents and Transaction Records Potentially Exposed
The information shared with the unauthorized party may have included customers’ names, dates of birth, postal addresses, email addresses and telephone numbers.
Copies of identity documents—including passports and driver’s licenses—may also have been disclosed, alongside verification selfies, account statements and transaction histories.
Former Mt. Gox CEO Mark Karpelès publicly shared a copy of Revolut’s customer notification after saying he was among those affected.
The notice indicated that potentially disclosed information included IBANs, withdrawal records and complete transaction histories, including Bitcoin transactions.
Revolut said it alerted the government agency involved, law enforcement officials, data protection authorities and financial regulators.
Onchain investigator ZachXBT suggested that the incident may have targeted wealthy customers. Although its scope appears limited, he said the affected accounts seemed to include high-net-worth users.
Revolut Continues US Banking and Crypto Expansion
The security incident comes as Revolut expands its banking and cryptocurrency businesses.
Earlier this month, the US Office of the Comptroller of the Currency granted Revolut conditional approval as the company works to establish a national bank. The proposed institution is expected to provide conventional banking products, stablecoin services and federally insured offerings.
Revolut also began gradually introducing EURR, its first euro-backed stablecoin, to selected customers in Denmark, Poland and Portugal in August.
The company, which reported serving 80 million customers worldwide, plans to expand EURR across the European Economic Area.
The fintech firm has also been developing Revolut X, its stand-alone cryptocurrency trading platform. In July, it connected the exchange to third-party AI assistants, including Claude and Gemini, allowing users to analyze markets and initiate trades using natural-language instructions.
Crypto Firms Face Growing Data-Security Threats
Revolut’s incident follows several customer-data exposures affecting cryptocurrency and fintech companies.
SafePal disclosed in August that a weakness in an order-tracking system exposed personal information belonging to approximately 39,798 customers.
The affected data included names, contact details, shipping addresses and purchasing records, although private keys, recovery phrases and funds remained secure.
Hardware-wallet manufacturer Trezor also said a breach involving logistics provider ShipMonk affected roughly 67,000 US customers. Exposed records included names, email addresses, phone numbers, delivery addresses and order information.
In a separate incident, attackers exploited one of Trezor’s third-party email providers to distribute phishing messages from a legitimate domain. Like the Revolut case, the incident demonstrates how criminals can abuse trusted communications infrastructure without directly compromising a company’s core systems.
