Revolut identified a sophisticated impersonation scam involving an unauthorized third party using a legitimate government agency domain email to fraudulently request user information. This led to the unintentional disclosure of personal and financial data of a subset of users. The compromised data included names, addresses, phone numbers, email addresses, dates of birth, occupation, copies of driver’s licenses and passports, verification selfies, and financial information such as IBANs, account statements, withdrawal records, and full transaction history including Bitcoin transactions. The company immediately blocked the attacker’s email address and informed relevant government, enforcement, data protection, and financial regulators. Revolut stated that only a small number of users were affected and that their systems and funds were not compromised.

The breach exposed sensitive personal and financial information of a subset of Revolut users to an unauthorized third party impersonating a government agency. This exposure could lead to identity theft, financial fraud, and privacy violations for the affected individuals. However, Revolut’s systems and customer funds were not compromised, limiting the breach impact to data confidentiality rather than system integrity or availability.

Revolut has blocked the attacker’s email address and notified the relevant government, enforcement, data protection, and financial regulatory agencies. Affected users have been directly informed and provided with support. No further action is indicated at this time as the breach was caused by a sophisticated impersonation scam and has been contained. Users should remain vigilant for phishing or fraud attempts using their exposed information.