Revolut Confirms Breach via Fake Government Email Requests

Revolut confirmed it disclosed sensitive customer information to an unauthorized third party after fraudulent requests sent from a legitimate government agency email domain. TechCrunch reported the company said customer funds and its own systems were not touched. The confirmation sits alongside a customer notification email TechCrunch reviewed, not a platform remote-code exploit or a funds theft.

A spokesperson called it a sophisticated external impersonation scam. The company said a "limited" number of customers were impacted and that those customers were contacted directly. Revolut did not disclose the exact count, did not name the agency, and did not say whether the incident was limited to one market.

The customer notice said the exposed data included identity and contact details (birth date, postal and email addresses, phone numbers) and copies of identity documents, specifically passports and driver's licenses. The notice also said the data may have included verification selfies, account statements, and transaction histories.

Revolut blocked the email address after discovery and alerted the relevant government agency, law enforcement, and regulators. The spokesperson said "Revolut systems and customer funds are unaffected." Crypto researcher ZachXBT posted about the customer email and said the incident appeared targeted at high-net-worth users.

Victim count stays "limited," with no public number. The government agency is unnamed. Later social claims of VIP data dumps and ransom demands have not been confirmed by Revolut, and Help Net Security treats those Monday posts as unverified colour, not as a company statement.

The breach is government-domain impersonation of a KYC desk, a different path from IDScan's 150 million-plus license breach.

Some offers on this page may be paid placements or contain affiliate links.