Revolut Confirms Customer Data Breach Following Fraudulent Government Requests

The fintech company Revolut has confirmed that sensitive customer information was disclosed to unauthorized third parties after the company received fake requests from a government agency email domain. According to a spokesperson for the company, the fraudulent requests used a domain belonging to a real government structure and contained credentials that had previously passed the company's checks. Revolut stated that its systems and customer funds were not affected by the incident. Once the breach was detected, the company blocked the email address and notified the affected customers, government agencies, data protection authorities, and financial regulators.

Reports from TechCrunch indicate that the compromised data included birth dates, postal and email addresses, phone numbers, copies of identity documents such as passports and driver's licenses, and selfies used for identity verification. Some reports also mention that account statements and transaction histories were included. Revolut has not disclosed the exact number of affected individuals. An anonymous blockchain researcher, ZachXBT, suggested that the scale of the leak was small and may have targeted the company's wealthiest clients.

This event occurs as Revolut is in the final stages of obtaining a license to operate as a light bank in Israel. The company is also aiming for a potential public listing with a valuation of up to $200 billion. This is not the first security issue for the firm; three years ago, criminal organizations stole over $20 million by exploiting a flaw between the company's U.S. and European payment systems.