British fintech company Revolut has confirmed that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from a legitimate government agency email domain. The compromised information included customers’ personal identity and contact details such as birth dates, postal and email addresses, phone numbers, and copies of identity documents like passports and driver’s licenses. Additional data potentially exposed included verification selfies, account statements, and transaction histories.
Revolut notified affected customers via email and confirmed to TechCrunch that the breach impacted a limited number of users, though the exact number was not disclosed. The company also declined to specify whether the breach was confined to a particular market or to identify the government agency involved.
A Revolut spokesperson described the incident as a "sophisticated external impersonation scam" where an unauthorized party exploited a legitimate government domain to submit fraudulent data requests. Upon discovery, Revolut blocked the fraudulent email address and informed the relevant government agency, law enforcement, and regulatory bodies. The company emphasized that its systems and customer funds remained secure.
Revolut serves over 80 million customers worldwide and operates as a bank in more than 30 countries. The fintech has recently expanded into markets such as India, Mexico, France, and the UAE. Additionally, it received conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank in the United States, expected to launch by mid-2027.
Security researcher ZachXBT noted that the breach appeared to target high net worth customers. This incident occurs as Revolut considers a potential public listing that could value the company at up to $200 billion, significantly higher than its $75 billion private valuation in late 2023. The firm has also been growing its banking licenses across Europe and globally in recent months.