Revolut, the British fintech serving over 80 million customers worldwide, has disclosed a data breach caused by a sophisticated social engineering attack. The perpetrators impersonated a government agency, submitting what appeared to be a legitimate emergency data request from a real government email domain — one that passed authentication checks. Believing the request to be genuine, Revolut complied and handed over sensitive customer records.
The data transferred to the attackers is unusually comprehensive: full name, date of birth, occupation, postal address, email, phone number, copies of identity documents (passports and driver’s licenses), facial verification selfies collected during KYC account opening, IBAN numbers, account statements, withdrawal records, and complete transaction history including Bitcoin transactions. The Record reports that attackers appear to have targeted high-net-worth individuals, many of them involved in cryptocurrency businesses. Revolut says the breach affects a “limited number” of customers but has refused to provide a count. The company says it has blocked the attacker’s address and alerted the relevant government agency, financial regulators, and data protection authorities. Customer funds and Revolut systems were not compromised.
How to check if you’re affected
Affected products include Revolut personal and business banking accounts. Revolut is directly emailing customers whose data was shared. If you have received such a notification, treat your identity documents as potentially compromised and monitor your financial accounts for unauthorized activity. You should also review your Revolut transaction history for any transfers you did not make. If you use the same passport or document for other financial services, those services’ customer support can flag your file for extra scrutiny.