Revolut has confirmed that customer data was disclosed after attackers used spoofed government requests. The incident, which came to light on September 11, involved an unauthorized third party sending requests from an email address on a legitimate government agency's domain. Revolut's staff processed these requests as standard legal-compliance inquiries, releasing sensitive information before the deception was uncovered.
According to the customer notification, the requests carried genuine domain authentication credentials, leading Revolut to believe they were authentic. The company has described the incident as "a sophisticated external impersonation scam." Revolut has since blocked the address, notified the agency, law enforcement, and relevant regulators, and confirmed that its systems were not breached and no customer funds were touched.
The Financial Times reported on September 15 that Revolut contacted approximately 680 individuals believed to be affected. The company has not published an official figure, describing the group as "very limited." The identity of the impersonated agency and the duration of the unauthorized requests have not been disclosed.
What data was exposed
According to reports from TechCrunch and The Block, the disclosed data included full name, date of birth, occupation, home address, email address, and phone number, along with copies of passports or driving licenses and the facial verification image submitted during onboarding. Financial records included account statements with IBANs, withdrawal records, and full transaction histories, with some outlets reporting that Bitcoin activity was included. The notification clarified that no biometric facial telemetry data was involved, distinguishing between the selfie image and derived biometric data.
Not every affected individual had all categories exposed, but the combination of verified identity, financial status, and crypto transaction history creates a significant risk of targeted scams, including impersonation, phishing, and fraud.
Ransom demands and ongoing pressure
On September 13, files described as belonging to Revolut customers began appearing on Telegram, with a promise to publish more daily until the company pays a ransom. The Register and other outlets reported a demand of 10,000 Bitcoin. Revolut has declined to comment on the ransom, and neither the company nor law enforcement has confirmed the authenticity of the files or the identity of the posters. The situation places pressure on customers, as each new file turns an abstract "limited group" into a named person with a published passport.
Why this matters beyond Revolut
This incident highlights a critical gap in verification processes. Domain authentication confirms that a message came from a specific server, but it does not verify the authority of the sender or the legitimacy of the request. Security experts emphasize that sensitive data requests should be confirmed through a channel the requester did not choose, and no single person should be able to complete the release alone. This is a structural safeguard, not just a matter of staff vigilance.
The technique is not new. In 2022, Bloomberg reported that Apple and Meta had handed user data to attackers using forged emergency requests from compromised law-enforcement email accounts. Discord confirmed a similar incident. Revolut itself disclosed a breach in 2022 affecting roughly 50,000 customers, also achieved through social engineering, though that attack involved access to an internal database.
Revolut now serves more than 80 million people, received a full UK banking license in March, and on September 3 received preliminary conditional approval from the US Office of the Comptroller of the Currency for a national bank charter. This incident underscores that scale and regulatory maturity do not eliminate the risk of social engineering attacks. For investors, it serves as a reminder of the importance of robust verification processes in financial institutions. As the crypto industry builds trust, incidents like this highlight the need for trust built in bear markets and the ongoing challenges in liquidity wars that exchanges face.
This article is for informational purposes only and does not constitute financial advice.
