Revolut confirmed on September 12 that its compliance team inadvertently shared sensitive customer data after receiving fraudulent requests. The emails successfully bypassed SPF, DKIM, and DMARC authentication protocols while impersonating a government agency.
The exposed information includes full names, birth dates, contact details, copies of identification documents, transaction histories, and account statements. The company stated that no biometric data was compromised and no customer funds were stolen.
While the exact number of affected users remains undisclosed, reports suggest the incident targeted a specific group of high-net-worth individuals. On-chain analyst ZachXBT noted that the breach appears limited in scale.
Revolut has blocked the fraudulent email address and notified law enforcement and relevant regulatory bodies. The company is also coordinating with the government agency whose identity was used in the scam.
This incident follows a previous data breach in 2022 that impacted tens of thousands of customers. Unlike the prior event, which involved social engineering of an employee, this case targeted the company's compliance procedures.
