BreachPublished 14 Sep 2026

Revolut discloses data breach exposing financial info, passports

Source Bleeping Computer

Description

Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. [...]

Impact

The breach exposed sensitive personal and financial information of an undisclosed, very limited number of Revolut customers, including identity documents and detailed transaction histories. This exposure increases the risk of identity theft, financial fraud, and targeted attacks against affected individuals. However, Revolut's operational systems and customer funds were not compromised. The breach may particularly impact high net worth customers, potentially increasing the severity of consequences for those individuals.

Defensive guidance

Revolut has already blocked the attacker's email address and notified the relevant government agency, enforcement agencies, data protection authorities, and financial regulators. Customers affected have been informed. No further immediate action is required from customers or other parties as per Revolut's disclosures. Organizations should verify requests for sensitive data through multiple channels and implement strict verification processes to prevent similar social engineering attacks.

Summary

Revolut experienced a data breach where an attacker impersonated a government agency by sending a request from an unauthorized email account using the official government agency's email domain. Due to valid domain authentication credentials, Revolut provided the requested customer data, which included personally identifiable information (full name, date of birth, occupation), contact details, identity documents (passport, driver's license), facial verification images, and detailed financial records such as account statements and transaction histories including Bitcoin transactions. The breach impacted a very limited number of customers, with indications that high net worth users were targeted. Revolut confirmed that its systems and customer funds remain secure and that it promptly blocked the attacker's address and alerted government, enforcement, data protection, and financial regulators.

References

bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Sep 2026, 09:17 UTC

References

Community reviews