Revolut experienced a data breach where an attacker impersonated a government agency by sending a request from an unauthorized email account using the official government agency's email domain. Due to valid domain authentication credentials, Revolut provided the requested customer data, which included personally identifiable information (full name, date of birth, occupation), contact details, identity documents (passport, driver's license), facial verification images, and detailed financial records such as account statements and transaction histories including Bitcoin transactions. The breach impacted a very limited number of customers, with indications that high net worth users were targeted. Revolut confirmed that its systems and customer funds remain secure and that it promptly blocked the attacker's address and alerted government, enforcement, data protection, and financial regulators.

The breach exposed sensitive personal and financial information of an undisclosed, very limited number of Revolut customers, including identity documents and detailed transaction histories. This exposure increases the risk of identity theft, financial fraud, and targeted attacks against affected individuals. However, Revolut's operational systems and customer funds were not compromised. The breach may particularly impact high net worth customers, potentially increasing the severity of consequences for those individuals.

Revolut has already blocked the attacker's email address and notified the relevant government agency, enforcement agencies, data protection authorities, and financial regulators. Customers affected have been informed. No further immediate action is required from customers or other parties as per Revolut's disclosures. Organizations should verify requests for sensitive data through multiple channels and implement strict verification processes to prevent similar social engineering attacks.