Fintech company Revolut disclosed sensitive customer information after responding to a fraudulent request sent from an email address using a legitimate government agency domain. The company confirmed that an unauthorized third party impersonated an official entity to obtain the data.
The exposed records included full names, dates of birth, occupations, and contact details such as postal addresses, emails, and phone numbers. Furthermore, attackers gained access to verification documents, including passport copies, driver's licenses, and identity verification selfies.
The breach also compromised financial information, specifically account statements, IBANs, wallet reference numbers, and full Bitcoin transaction histories. Revolut stated that biometric facial telemetry data remained secure and was not part of the leaked information.
A company spokesperson described the incident as a sophisticated impersonation scam. Revolut confirmed that a limited number of customers were affected, though it declined to provide specific figures or identify the government agency involved in the impersonation.
Following the incident, Revolut blocked the malicious email address and notified law enforcement and regulators. The company emphasized that its internal systems and customer funds remain unaffected by this security breach.
Crypto investigator ZachXBT noted that the attack appeared to target high-net-worth individuals. The incident occurs as Revolut, which recently launched its euro-pegged stablecoin EURR, continues to evaluate plans for an initial public offering.
