Revolut Data Breach Exposes Customer IDs in Fake Agency Requests

Revolut has confirmed that an unauthorised third party obtained sensitive customer information after submitting fraudulent requests from an email address using a legitimate government agency domain. The requests passed valid technical domain authentication and were handled by Revolut employees as routine legal-compliance requests. The fintech said a “very limited group of customers” was affected, while its systems and customer funds were not compromised. It did not disclose the number of customers involved, or whether a particular market or department was affected.

Independent crypto-security researcher ZachXBT raised the issue on 12 September, sharing a Revolut notification sent to customers the previous day. The data reportedly included names, dates of birth, addresses, telephone numbers, email addresses, occupations, identity documents and verification selfies. ZachXBT also claimed that IBANs, account-opening dates, transaction and withdrawal histories, and Bitcoin wallet reference numbers were exposed.

Revolut said it blocked the address immediately after detecting the activity, notified affected customers, and contacted the relevant government agency, law-enforcement bodies, data-protection authorities and financial regulators.

Security experts warned that the information could support identity fraud and highly targeted phishing, despite no reported impact on funds or Revolut’s systems. Affected users were advised to treat unexpected messages claiming to come from Revolut, government organisations or other trusted bodies with caution, never share passwords, passcodes or one-time codes, and contact Revolut only through its official app or verified website. Revolut also recommended monitoring accounts and credit reports for unusual activity and reporting suspected identity misuse.