Back Kucoin

Revolut Confirms Limited Customer Data Breach via Impersonation Scam

Kucoin • September 13, 2026

ME News report, September 13 (UTC+8): Revolut disclosed that it inadvertently exposed sensitive customer information to an unauthorized third party, which submitted a fraudulent request for records using what appeared to be a legitimate government agency email domain. Revolut described the incident as a “carefully orchestrated external impersonation scam” and stated that it had blocked the email address upon identification. Revolut’s systems and customer funds were unaffected.

Revolut said the number of affected customers was limited and that it had contacted them directly. The leaked information may include customers’ names, dates of birth, mailing addresses, email addresses, phone numbers, and copies of identity documents such as passports and driver’s licenses. Additionally, self-portraits used for identity verification, account statements, and transaction records may also have been compromised.

Previously, ZachXBT monitored that Revolut allegedly leaked some users’ personal information due to failure to identify fraudulent requests. (Source: PANews)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Revolut Data Breach: Fraudulent Government Email Exposes Customer Information On September 11 and 12, 2026, Revolut disclosed sensitive customer data after falling victim to a sophisticated impersonation scam. An unauthorized party used a legitimate government agency's email domain to submit fraudulent requests for customer information, which Revolut mistakenly treated as valid. The exposed data includes full names, dates of birth, addresses, email addresses, phone numbers, copies of identity documents, verification selfies, IBANs, and complete transaction histories, including Bitcoin activity. Revolut has characterized the incident as limited in scope, primarily affecting high-net-worth individuals, but has not disclosed the exact number of impacted customers. The company has since blocked the fraudulent email address and notified relevant authorities. Importantly, no customer funds or login credentials were compromised. The incident has raised concerns about the security of KYC processes in the fintech sector. 100 sources 53

Extracted Entities

Revolut Confirms Limited Customer Data Breach via Impersonation Scam

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)