Revolut Confirms Customer Data Breach Due to Spoofed Government Request

The UK fintech company Revolut confirmed that it disclosed certain customer sensitive information to unauthorized third parties due to fraudulent requests appearing to come from legitimate government agency email domains. The company has directly notified affected customers but has not disclosed the exact number of individuals impacted or whether the incident was concentrated in a specific market.

The leaked information involves identity and transaction data.

According to the notice sent to affected customers, the leaked information includes identity and details such as name, date of birth, mailing address, email, and phone number, and may also include copies of identification documents such as passports or driver’s licenses.

The company also stated that some of the data may include identity verification selfies, account statements, and transaction records, indicating that the breach extends beyond basic personal information to potentially include account usage details.

The company stated that funds and systems were unaffected.

Revolut stated that this was a "complex external impersonation scam." The perpetrators exploited email domains belonging to legitimate government agencies to submit fraudulent data access requests. Upon detecting the anomaly, the company has blocked the relevant email addresses and notified the pertinent government bodies, law enforcement agencies, and regulatory authorities.

Revolut also stated that its internal systems and customer funds were not affected. The company emphasized that the scope of the impact was "limited," but declined to disclose the number of individuals involved or the name of the government agency concerned.

The event occurred during the business expansion phase.

The company disclosed that Revolut, headquartered in London, has over 80 million customers globally and operates as a bank in more than 30 countries. The company has recently continued to expand internationally, with market presence in India, Mexico, France, and the UAE.

Earlier this month, the U.S. Office of the Comptroller of the Currency conditionally approved Revolut’s establishment of a national bank in the United States. The company expects the related services to launch in the first half of 2027.

Cryptocurrency security researcher ZachXBT previously disclosed an email sent by Revolut to affected customers, suggesting that the incident may have targeted high-net-worth individuals. Meanwhile, market reports indicate that Revolut is evaluating a potential IPO, with a valuation as high as $200 billion—up from its private valuation of approximately $75 billion in November last year.

Additional information: In recent months, Revolut has obtained banking licenses in France and the UK, and is simultaneously expanding its banking operations across Europe and globally.