Revolut has disclosed a data-security incident in which sensitive customer information was released after the fintech company responded to a fraudulent request masquerading as a legitimate government-agency inquiry.
The event allegedly exposed a limited number of users’ KYC records and detailed financial information, raising concerns about identity fraud, phishing, and targeted crypto scams.
According to CSN, the disclosure did not stem from compromise of its core systems, mobile application, or customer accounts. Instead, an attacker used an unauthorized email account under a government agency domain to impersonate the agency.
Revolut Data Breach
Domain-authentication credentials appeared valid, so staff treated the message as an authentic request. The response included names, dates of birth, occupations, postal addresses, email addresses, and telephone numbers.
It also contained passport or driving-license copies, selfies, account statements, IBANs, account-status details, opening dates, wallet reference numbers, withdrawal records, and transaction histories. Revolut said customer funds remained safe and internal systems were not compromised.
Revolut emphasized that biometric facial telemetry was neither involved nor compromised. Nonetheless, stolen scans and verification selfies can increase impersonation risk.
Criminals may combine these artifacts with contact information and financial details to craft communications, evade verification checks, or attempt account-recovery fraud against banks, exchanges, mobile carriers, and service providers.
Financial records extend beyond balances, including statements and transaction data that may show Bitcoin-related activity. Such records can reveal wealth, trading behavior, wallet usage, timing, and relationships with exchanges or counterparties.
This intelligence may enable customized cryptocurrency theft attempts, investment fraud, extortion, or social-engineering campaigns against high-value targets.
Revolut characterized the incident as social engineering, not an infrastructure breach. The company said it blocked the unauthorized email source, notified relevant authorities, and contacted affected customers.
Yet the episode highlights a weakness in data workflows: a trusted domain and authentication do not prove a sender account is authorized.
Industry concern is likely to focus on mandatory KYC collection by banks, fintech platforms, and cryptocurrency services. When identity documents, selfies, contact data, and transaction histories are assembled in one disclosure, attackers receive a high-resolution profile.
Cryptocurrency community figures, including on-chain investigator ZachXBT, highlighted claims that attackers targeted high-net-worth users.
For affected customers, the combined dataset can support convincing lures impersonating Revolut support, police, tax authorities, or cryptocurrency exchanges.
Attackers can reference addresses, account details, and transaction events to manufacture urgency and credibility. Risks include credential harvesting, SIM-swapping, fraudulent account recovery, malicious wallet-draining links, extortion, and physical threats.
Organizations handling high-risk records should validate legal or government requests through an out-of-band channel, using contact details rather than paths in the request.
They should apply request minimization, dual authorization, logging, and escalation procedures before releasing data. The incident shows that authentication protects domains, but cannot alone verify sender legitimacy.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
