Revolut confirms customer data breach through fake government requests

Your personal documents and contact information, previously held securely by Revolut, are now potentially in the hands of bad actors.

Revolut has confirmed a data breach affecting a limited number of its customers, which occurred through a sophisticated phishing scam. An unauthorized third party impersonated a legitimate government agency, using a fraudulent government domain email to submit fake requests for customer information. The exposed data included identity and contact details such as birth dates, postal and email addresses, phone numbers, and potentially copies of identity documents like passports and driver's licenses. Verification selfies, account statements, and transaction histories may also have been compromised. Revolut stated that its systems and customer funds remain unaffected and that it has blocked the fraudulent email address, alerted relevant authorities, and notified affected customers. The exact number of impacted individuals and the specific government agency involved were not disclosed. The incident comes as Revolut, a fintech company with over 80 million customers globally, is reportedly considering a public listing and expanding its banking operations.

This incident highlights a significant vulnerability in how financial institutions handle government information requests. The use of a legitimate-looking government domain email suggests a need for more robust verification protocols beyond email authentication, especially when dealing with sensitive customer data. The potential compromise of identity documents and transaction histories could expose users to identity theft and financial fraud, impacting a broad range of Revolut's global customer base. Moving forward, financial firms will likely face increased scrutiny regarding their data security measures and incident response protocols. Regulators may introduce stricter guidelines for verifying external information requests, potentially leading to longer processing times for legitimate requests but enhancing overall customer protection. Users should remain vigilant for any suspicious activity related to their personal information and financial accounts.

The breach, reportedly targeting high-net-worth individuals, signals a concerning trend of targeted attacks against financial services customers. As Revolut expands its global banking footprint and considers a major public listing, such security incidents could significantly impact investor confidence and its valuation. The company's ability to manage this crisis, transparently communicate with customers and regulators, and fortify its security against future sophisticated impersonation scams will be critical for its continued growth and reputation. Other fintech companies will likely re-evaluate their own third-party risk management and data request verification processes. This event underscores the persistent threat landscape and the ongoing arms race between cybercriminals and security professionals in the financial sector. The incident also raises questions about the security of government communication channels and the safeguards in place to prevent their misuse for malicious purposes.