Revolut Reveals Sensitive Customer Data to Unauthorized Third Party

The Anatomy of a Sophisticated Impersonation Breach

British financial technology giant Revolut has officially confirmed that it inadvertently disclosed sensitive customer information to an unauthorized third party, following a high-level security failure involving a compromised government email domain. In a notification dispatched to impacted users, the company revealed that the breach stemmed from a “sophisticated external impersonation scam.” The perpetrators successfully leveraged a legitimate government agency email domain-which Revolut has notably refused to identify-to issue formal, fraudulent requests for user data.

The scope of the compromised data is extensive and carries significant identity theft risks for the affected individuals. According to documentation reviewed Furthermore, the breach compromised high-sensitivity documentation, including copies of government-issued passports and driver’s licenses. In more severe instances, the unauthorized parties obtained biometric verification selfies, comprehensive account statements, and detailed transaction histories.

While Revolut asserts that the incident was limited to a specific subset of its global user base, the depth of the data leaked provides attackers with a “full-profile” set, which is highly valuable for advanced social engineering and downstream financial fraud.

Read More: Bending Spoons Acquires Miro for $1.36 Billion, 90% Less Than 2022 Valuation

Operational Implications and Regulatory Scrutiny

The incident arrives at a precarious moment for the London-based fintech, which currently boasts a global footprint of over 80 million users and operates across 30 distinct markets. As the company aggressively maneuvers toward a potential public listing-with internal valuations reportedly eyeing the $200 billion mark-this breach serves as a stark reminder of the operational risks inherent in rapid global scaling.

Despite the severity of the data exposure, a Revolut spokesperson maintained that the firm’s core banking systems and actual customer funds remained insulated from the attack. The company acted quickly to blacklist the compromised email address, notify law enforcement, and coordinate with international data regulators to mitigate the fallout.

However, the firm’s refusal to disclose the specific government agency involved or the precise number of victims has drawn criticism from privacy advocates who argue that transparency is essential for restoring consumer trust following such a breach.

Market observers and industry experts, including prominent crypto-security researcher ZachXBT, have highlighted that the nature of these requests suggests a targeted strike rather than a generic phishing campaign. The specificity of the data requested implies that the attackers aimed for high-net-worth individuals, potentially intending to use the stolen credentials to This event raises urgent questions regarding the protocols that fintech institutions use to verify "legal" requests from government entities.

Also Read: Listen Labs Scraps $125M Series C Amid Salesforce Acquisition Bid

As Revolut continues to secure banking licenses in major jurisdictions-including recent successes in France and the UK, and conditional approval for a U.S. national bank license due for 2027-the firm is expected to face intensified scrutiny from the U.S. Office of the Comptroller of the Currency and other regulatory bodies regarding its internal verification and cybersecurity infrastructure.

The Evolving Landscape of Fintech Security

This breach underscores a growing trend in cybercrime where attackers pivot from exploiting software vulnerabilities to exploiting human-centric institutional processes. For Revolut, the path forward involves not only remediating the damage for affected customers-likely through complimentary credit monitoring and identity theft protection services-but also fundamentally re-engineering how it validates external requests from law enforcement and government agencies.

As the company accelerates its global expansion into competitive markets like India, Mexico, and the UAE, the requirement for a more resilient, multi-factor verification process for inbound legal requests has become a primary operational imperative to maintain its competitive standing and meet evolving international regulatory standards for data protection.