Revolut experienced a data breach involving the exposure of sensitive customer information after a phishing attack bypassed standard email security protocols. The incident occurred when a fraudulent email, masquerading as an official government communication, successfully passed SPF, DKIM, and DMARC authentication checks.
The company's compliance team processed the request, inadvertently providing an unauthorized third party with identity documents, verification selfies, full names, dates of birth, contact details, financial records, and Bitcoin transaction histories. Revolut stated that the number of affected customers is limited, though it did not provide a specific count.
The company confirmed that no internal systems were compromised, and no passwords, private keys, or customer funds were stolen. Revolut has since blocked the malicious email address and notified law enforcement and regulatory bodies about the incident.
This security failure occurs as Revolut pursues a banking license and explores a public listing with a valuation target of $200 billion. The breach highlights vulnerabilities in compliance workflows when handling external data requests.
