Revolut confirms customer data breach via fraudulent government agency requests

Fraudulent Requests Led to Data Exposure

Fintech company Revolut confirmed that it inadvertently disclosed sensitive customer information to an unauthorized third party. The breach occurred after the company received fraudulent data requests that originated from an email domain belonging to a legitimate government agency. This sophisticated impersonation scam bypassed Revolut's initial security checks, leading to the data release.

Scope of Exposed Customer Data

The compromised data includes customers' identity and contact details such as birth dates, postal and email addresses, phone numbers, and copies of identity documents like passports and driver's licenses. Revolut's notification to affected customers also indicated that verification selfies, account statements, and transaction histories might have been exposed. The company stated that a "limited" number of customers were impacted but did not provide an exact figure or specify if the incident was geographically limited.

Revolut's Response and Unaffected Systems

Upon discovering the scam, Revolut blocked the fraudulent email address and alerted the relevant government agency, law enforcement, and regulators. The company emphasized that its systems and customer funds remain unaffected by this incident. Revolut has over 80 million customers globally and operates as a bank in more than 30 countries, with recent expansions and regulatory approvals, including conditional approval for a national bank in the U.S.

Context and Industry Implications

The incident was brought to public attention by crypto security researcher ZachXBT, who noted that the breach appeared to target high-net-worth users. This event occurs as Revolut reportedly considers a potential public listing, which could value the company significantly. Such security incidents can impact customer trust and regulatory scrutiny, particularly for financial institutions handling sensitive personal and financial data.