Customers lose control of personal data after Revolut says an unauthorized third party obtained identity records and contact information by submitting fake requests that used a legitimate government agency email domain. The fintech told affected clients directly that the breach included birth dates, postal and email addresses, phone numbers and copies of identity documents.
Revolut said verification selfies, account statements and transaction histories may also have been disclosed, and that a "limited" number of customers were impacted. The company did not provide a headcount, say whether the incident was confined to a particular market, or name the government agency whose domain was abused.
A Revolut spokesperson described the incident as a "sophisticated external impersonation scam" in which an unauthorized actor submitted fraudulent information requests from an email address that appeared to originate from a government domain. The firm said it blocked the email address after discovering the scam and has informed the relevant government agency, law enforcement and financial regulators. "Revolut systems and customer funds are unaffected," the spokesperson added.
Security researcher ZachXBT posted about the company's email to customers and said the incident appeared to target high net worth users. Revolut itself confirmed it had contacted the people whose information was exposed.
The company has grown rapidly in recent years, reporting more than 80 million customers worldwide and operating as a bank in over 30 countries. It has expanded into markets including India, Mexico, France and the UAE, and recently received conditional approval from the U.S. Office of the Comptroller of the Currency to set up a national bank expected to launch in the first half of 2027.
The breach arrives as Revolut is reported to be weighing a public listing that could value the business at as much as $200 billion, up from a $75 billion private valuation in November. With regulators and law enforcement notified, the next steps are investigations and any regulatory scrutiny that follows, while affected customers await details on mitigation and monitoring from the company.
