Revolut Customer Data Exposed in Security Breach

Revolut has confirmed that sensitive customer information was exposed to an unauthorized third party after fraudsters used email addresses belonging to a legitimate government institution to submit fraudulent requests to the company.

The digital banking company said it acted immediately after detecting the breach, blocking the address involved and notifying the relevant government institution, law enforcement agencies, data protection authorities and financial regulators.

“Upon identifying the incident, we immediately blocked the address and notified the relevant government institution, as well as law enforcement, data protection authorities, and financial regulators,” a Revolut spokesperson said, according to Reuters.

Revolut said its systems and customer funds were not affected by the incident. The company has not disclosed how many customers were impacted by the unauthorized access.

Information believed to have been exposed includes customers' dates of birth, email addresses, phone numbers and copies of identity documents. However, there is currently no evidence that the attackers obtained passwords, card PINs or private cryptographic keys.

There are also no indications that the breach resulted in funds being stolen directly or that attackers took control of customer accounts.

Blockchain analysts said the incident appears to have been limited in scope and may have affected primarily customers holding larger amounts of assets. The exact scale of the exposure remains unclear.

The breach comes alongside warnings about a separate scam targeting Revolut customers, in which users have received fraudulent phone calls from people claiming to represent the company.

The combination of the data exposure and impersonation attempts raises concerns that leaked personal information could potentially be used in further scams or social-engineering attacks. However, the available information does not indicate that account passwords, PINs or private cryptographic keys were compromised.

Revolut's confirmation therefore points to a customer-data exposure rather than a direct breach of customer funds, with investigations and notifications to authorities already underway.