Revolut Discloses Data Breach Involving Passports and Financial Information

Fintech firm Revolut has disclosed a data breach after sensitive customer information, including passports and transaction histories, was shared with a threat actor impersonating a government agency.

Attack via Government Impersonation

The breach occurred after Revolut received a request for customer information that appeared to originate from a legitimate government agency. The attacker used an unauthorised email account that utilised valid domain authentication credentials from an official government domain.

Revolut stated that the request was fulfilled under the “reasonable belief” that it was an authentic official request due to the presence of these valid authentication credentials.

Exposed Personal and Financial Data

The data shared with the threat actor included a wide range of personally identifiable information (PII) and sensitive financial records. According to the company, the exposed details include:

• Identity details: Full names, dates of birth, and occupations.
• Contact information: Postal addresses, email addresses, and telephone numbers.
• Verification documents: Copies of passports, driver’s licenses, and facial verification images (selfies) provided during the Know Your Customer (KYC) process.
• Financial history: Account statements including International Bank Account Numbers (IBANs), withdrawal records, and full transaction histories, including Bitcoin transactions.

Scope and Company Response

Revolut has described the number of affected customers as “very limited” but has declined to provide an exact figure. However, crypto fraud investigator ZachXBT suggested the incident may have been specifically targeted at high net worth users.

The company confirmed that its core systems and customer funds remain unaffected. Upon detecting the unauthorised activity, Revolut blocked the fraudulent address and alerted relevant government agencies, financial regulators, and law enforcement authorities.

This incident follows a previous breach in September 2022, in which attackers stole the personal and financial information of 50,150 Revolut customers.