Fintech Giant Revolut Compromised by Sophisticated Phishing Scam, Exposing Sensitive Customer Data
Revolut, the prominent fintech firm, has disclosed a significant data breach that resulted in the exposure of sensitive customer information, including passport copies and detailed Bitcoin transaction histories. The breach occurred after the company fell victim to a fraudulent request disguised as a legitimate government inquiry.
Details of the Breach
According to a customer notification shared by crypto investigator ZachXBT, Revolut received a request for customer data that appeared to originate from a government agency. The request was sent from an unauthorized email account that had successfully spoofed the agency’s official domain. Crucially, the message included valid domain authentication credentials, leading Revolut to believe the request was genuine and proceed with fulfilling it.
The compromised data is extensive, encompassing a wide range of personal and financial details. Affected customers had their full names, dates of birth, and occupations exposed. Contact information, including postal addresses, email addresses, and phone numbers, was also compromised. Furthermore, identity verification documents, such as copies of passports or driver’s licenses, and verification selfies were handed over.
For cryptocurrency holders, the breach is particularly concerning as it includes financial data such as account statements with IBAN and wallet reference numbers, withdrawal records, and complete transaction histories, including Bitcoin transactions. Revolut has stated that no biometric facial telemetry data was involved in the incident.
Revolut’s Response and Impact
A spokesperson for Revolut confirmed the breach to TechCrunch, characterizing it as “a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.”
The company indicated that a “limited” number of customers were affected. Revolut has since blocked the fraudulent email address and has alerted the relevant government agency, law enforcement, and regulatory bodies. The company maintained that its internal systems and customer funds remain unaffected. Revolut declined to specify the exact number of customers impacted or the identity of the government agency that was impersonated.
Wider Implications and Industry Concerns
ZachXBT suggested that the incident may have specifically targeted high-net-worth individuals, a development that raises concerns given the recent increase in violent “wrench attacks” against known cryptocurrency holders. The leak has drawn sharp criticism from users on social media, with many arguing that the episode highlights how know-your-customer (KYC) regulations may create risks without delivering commensurate benefits.
One user, Marc Zeller, posted on social media platform X (formerly Twitter), “Woke up to all my data leaked by @Revolut. Sharp reminder that KYC hasn’t produced meaningful upside and has put many in harm’s way.”
This breach occurs during a challenging period for companies that hold personal data of cryptocurrency users. Hardware wallet manufacturer Trezor recently experienced a support-vendor breach that exposed tens of thousands of additional customers. Separately, X (formerly Twitter) appeared to suffer its own data breach, which led to a flood of password reset requests for its users.
Revolut, which launched its euro-pegged EURR stablecoin earlier this year, is reportedly considering an initial public offering (IPO).
Leave a Reply