Revolut Data Breach: Fraudulent Government Email Exposes Customer Information

• •Revolut mistakenly disclosed sensitive customer data due to a fraudulent government email request.
• •The exposed information includes identity documents, transaction histories, and Bitcoin activity.
• •No customer funds or login credentials were compromised in the incident.

On September 11 and 12, 2026, Revolut disclosed sensitive customer data after falling victim to a sophisticated impersonation scam. An unauthorized party used a legitimate government agency's email domain to submit fraudulent requests for customer information, which Revolut mistakenly treated as valid. The exposed data includes full names, dates of birth, addresses, email addresses, phone numbers, copies of identity documents, verification selfies, IBANs, and complete transaction histories, including Bitcoin activity. Revolut has characterized the incident as limited in scope, primarily affecting high-net-worth individuals, but has not disclosed the exact number of impacted customers. The company has since blocked the fraudulent email address and notified relevant authorities. Importantly, no customer funds or login credentials were compromised. The incident has raised concerns about the security of KYC processes in the fintech sector.