British fintech Revolut suffered a customer data breach after an unauthorized third party used a legitimate government agency email domain to submit fraudulent information requests, according to a company notification reviewed by TechCrunch. The exposed data includes personal details and identity documents for a limited number of users.
Exposed Customer Data and Affected Information
The security incident compromised sensitive identity and contact details, according to customer notifications sent by Revolut and reported by TechCrunch. The exposed records include customer birth dates, postal addresses, email addresses, and phone numbers. Fraudsters also obtained copies of official identity documents such as passports and driver’s licenses.
According to Revolut’s notification, the compromised data may have also included verification selfies, account statements, and transaction histories. Crypto security researcher ZachXBT posted on social media that the email notifications sent to affected users indicated the incident appeared to target high-net-worth individuals.
Company Response and Regulatory Notifications
Revolut stated that it blocked the unauthorized email address immediately after discovering the breach and alerted the relevant government agency, law enforcement, and regulatory bodies. A company spokesperson confirmed to TechCrunch that a “limited” number of customers were impacted and that the firm contacted those individuals directly, though the company declined to disclose the exact number of affected users or name the specific government agency involved.
“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” the Revolut spokesperson said in a statement provided to TechCrunch. The company emphasized that its core systems and customer funds remain unaffected by the incident.
Global Operations and Regulatory Context
London-based Revolut operates as a bank in more than 30 countries and serves more than 80 million customers worldwide, according to its official website. The fintech has recently expanded its international footprint into markets including India, Mexico, France, and the United Arab Emirates.
The data breach coincides with a period of significant regulatory and corporate milestones for the company. Earlier this month, the U.S. Office of the Comptroller of the Currency granted conditional approval for Revolut to establish a national bank in the United States, with a targeted launch in the first half of 2027. Additionally, the firm has secured banking licenses in both the UK and France in recent months as it reportedly weighs a potential public listing that could value the company at up to $200 billion.
Keep reading