Fintech giant Revolut has confirmed a data breach involving customer personal information. Attackers bypassed internal compliance protocols by submitting fraudulent emergency data requests (EDR) that mimicked official government and law enforcement documents.
The compromised data includes customer names, email addresses, phone numbers, transaction histories, and account metadata. Revolut stated that core financial security credentials, such as passwords, PINs, and bank card numbers, remain secure. User funds and the company's underlying encryption architecture were not affected.
Upon detecting unusual data flows, Revolut initiated an emergency response, blocked the attack, and launched a retrospective audit of all law enforcement requests. The company has reported the incident to data protection regulators and is working with cybersecurity experts to identify the attackers.
To prevent future incidents, Revolut is restructuring its legal request review system. The company is implementing stricter offline verification mechanisms and upgrading automated anti-fraud and credential cross-validation processes. Affected users have been notified and advised to remain vigilant against potential phishing attempts.
