Revolut Exposed User Data After Fake Government Request

Revolut Exposed Sensitive Customer Data Following Sophisticated Phishing Attack

Financial technology firm Revolut inadvertently disclosed highly sensitive personal and financial information belonging to some of its customers after falling victim to what appears to have been a sophisticated phishing operation masquerading as an official government request.

The breach, revealed by on-chain investigator ZachXBT, involved the company sending emails to affected users admitting that exposed records included passports, verification selfies, addresses, and comprehensive Bitcoin transaction histories.

In the communication to customers, shared by ZachXBT on his Telegram channel, Revolut stated it had received a request for information that seemed to originate from a legitimate government agency. The company clarified that the sender was not simply spoofing an official-looking address. Instead, the request originated from an unauthorized email account that utilized the government agency’s actual email domain and possessed valid domain authentication credentials.

Believing the request to be authentic, Revolut proceeded to fulfill it. The disclosed information potentially encompassed customers’ full names, dates of birth, occupations, home addresses, email addresses, and phone numbers. More critically, the exposed data included copies of passports and/or driver’s licenses, along with the selfie images provided by clients during the identity verification process. Revolut did note, however, that biometric facial telemetry itself was not compromised.

The firm also confirmed that financial information was shared, including account statements containing IBANs, account-opening dates, and wallet reference numbers. Withdrawal records and complete transaction histories, including Bitcoin transactions, were also part of the compromised data.

Revolut has not publicly identified the government agency targeted by the phishing attempt, and the notification to customers does not specify whether passwords, private keys, or customer funds were accessed.

ZachXBT described the incident as “likely limited in size,” suggesting that the perpetrators may have targeted high-net-worth individuals. However, this remains unconfirmed by independent sources or Revolut. The company has also not disclosed the total number of affected clients.

Based on the information available, the incident appears to be a case of unauthorized disclosure rather than a direct breach of Revolut’s internal systems. The company’s standard procedure for government and law enforcement agencies is to submit official information requests through a dedicated, secure channel.