Revolut disclosed personal and financial data of several customers following a fraudulent request. The company received an inquiry that appeared to originate from a government agency but was sent from an unauthorized email account using an official domain and valid authentication credentials.
The compromised information includes full names, dates of birth, occupations, contact details, and identity verification documents such as passport copies and selfies. Financial data exposed in the incident covers account statements, IBANs, withdrawal records, and transaction histories, including Bitcoin activity.
According to onchain researcher ZachXBT, the incident appears to be limited in scale but specifically targeted high-net-worth users. The company reportedly failed to verify the legitimacy of the request before sharing the data. Biometric facial telemetry was not included in the disclosure.
