Fintech firm Revolut has confirmed a data breach involving the disclosure of sensitive customer information to an unauthorized third party. The incident occurred after attackers used a legitimate government agency email domain to submit fraudulent data requests to the company.
Exposed records include customer identity details, contact information, birth dates, and copies of passports or driver’s licenses. The company stated that verification selfies, account statements, and transaction histories may also have been accessed during the breach.
A spokesperson for the London-based firm confirmed that a limited number of users were affected and that the company has notified them directly. Revolut has blocked the malicious email address and reported the incident to law enforcement and relevant regulators.
Revolut currently serves over 80 million customers globally and operates as a bank in more than 30 countries. The company recently secured conditional approval to establish a national bank in the United States, with a planned launch in the first half of 2027.
The security incident follows reports that Revolut is considering a public listing that could value the company at up to $200 billion. The firm previously held a private valuation of $75 billion as of November.
