Home · Technology · Sep 12 archive
Revolut Confirms Customer Data Breach Through Fake Government Requests
Confirmed
In Short: Revolut has confirmed a data breach after complying with a fraudulent government request, affecting a 'limited number' of its customers.
Revolut has confirmed a data breach following a sophisticated external impersonation scam, where a fake government request led the financial institution to share sensitive customer data. A Revolut spokesman told BNO News that the company immediately blocked the address and alerted relevant authorities upon detection, but did not specify the number of affected customers.
The fraudulent communication originated from a genuine government agency email domain and passed standard domain verification protocols, leading Revolut to believe it was legitimate. According to reports, the information shared included KYC data such as full names, dates of birth, occupations, postal addresses, email addresses, and phone numbers, as well as copies of ID documents and selfies taken by customers to confirm their identity.
In a statement to BNO News, Revolut emphasized that customer funds and systems were unaffected by the breach. However, the data also included account statements with IBAN numbers, account statuses, opening dates, and wallet reference numbers, as well as withdrawal records and a full transaction history, including Bitcoin transactions. The company is currently reaching out to affected customers to inform them of the incident and provide additional support.
ZachXBT, a blockchain investigator, published a customer notification via Telegram on September 11, highlighting the breach. The message, which passed domain authentication checks, tricked Revolut into releasing sensitive personal information (PII) of its customers. Neither Revolut nor the notification provided a confirmed count of affected users.
Financial institutions are legally required to comply with official requests from law enforcement or government agencies, typically communicated through verified email addresses. Revolut, with over 70 million customers in 40 countries, is valued at $75 billion, making the breach particularly concerning for its user base and reputation.
What's confirmed
- Revolut has confirmed a data breach following a sophisticated external impersonation scam, where a fake government request led the financial institution to share sensitive customer data. A Revolut spokesman told BNO News that the company immediately blocked the address and alerted relevant authorities upon detection, but did not specify the number of affected customers.
- The fraudulent communication originated from a genuine government agency email domain and passed standard domain verification protocols, leading Revolut to believe it was legitimate. According to reports, the information shared included KYC data such as full names, dates of birth, occupations, postal addresses, email addresses, and phone numbers, as well as copies of ID documents and selfies taken by customers to confirm their identity.
- In a statement to BNO News, Revolut emphasized that customer funds and systems were unaffected by the breach. However, the data also included account statements with IBAN numbers, account statuses, opening dates, and wallet reference numbers, as well as withdrawal records and a full transaction history, including Bitcoin transactions. The company is currently reaching out to affected customers to inform them of the incident and provide additional support.
- ZachXBT, a blockchain investigator, published a customer notification via Telegram on September 11, highlighting the breach. The message, which passed domain authentication checks, tricked Revolut into releasing sensitive personal information (PII) of its customers. Neither Revolut nor the notification provided a confirmed count of affected users.
- Financial institutions are legally required to comply with official requests from law enforcement or government agencies, typically communicated through verified email addresses. Revolut, with over 70 million customers in 40 countries, is valued at $75 billion, making the breach particularly concerning for its user base and reputation.
What's still developing
- “The infuriating part is that it happens right after Revolut sent me a notification to provide a LOT of data or ‘we will close your account in 20 days’,” Zeller wrote on X, formerly known as Twitter.
- A Revolut spokesperson told BeInCrypto the bank blocked the sender as soon as it spotted the problem.
- Passcodes, login details, and biometric data were never exposed, the bank told BeInCrypto.
- Revolut will not say which agency’s domain was used, citing the live police investigation.
- Revolut disclosed that it complied with a fraudulent government request using a spoofed official email and valid credentials, exposing PII… pic.twitter.com/3RPO6OYs1N According to Revolut, the organization processed the request based on its seemingly legitimate characteristics.
- ZachXBT said multiple customers received an alert email on Friday, Sep. 11, but neither he nor the portion of the notice shown in his post gave a confirmed count of affected users.