Revolut confirmed that an unauthorized third party successfully obtained customer data by impersonating a government agency. The attacker used a legitimate government email domain to submit fraudulent requests, which the bank initially accepted as authentic.
The compromised files included sensitive personal information such as passport copies, driving licenses, home addresses, bank statements, and detailed records of Bitcoin transactions. Revolut stated that login credentials, passcodes, and biometric data remained secure.
The company reported that it blocked the sender upon discovering the incident and notified the relevant government agency, police, and financial regulators. Revolut has contacted the limited number of affected users regarding the breach.
The bank has declined to disclose the specific government agency involved, citing an ongoing police investigation. Blockchain investigator ZachXBT noted that the attack appeared to target a small group of wealthy users.
