Revolut has confirmed that it has experienced a significant data breach, raising concerns among its customer base. On September 14, a spokesperson for the fintech firm spoke with Infosecurity, revealing that an unauthorized third party had submitted “fraudulent requests for information” using what appeared to be a legitimate email address linked to a government agency. This tactic was classified by Revolut as a “sophisticated external impersonation scam,” resulting in the inadvertent disclosure of sensitive customer information to a threat actor.
The malicious requests employed by the attackers came with valid technical domain authentication, which led to their compliance by Revolut employees as part of standard legal operating procedures. According to the company’s statement, the impact of the breach was somewhat confined, as it affected only a “very limited group of customers.” They assured that the integrity of its systems and customer funds remained intact, a point that may offer some reassurance amidst the chaos. However, Revolut has chosen not to disclose further details about the number of affected customers or any specific sectors or markets that might have been compromised.
In the immediate aftermath of the breach, the spokesperson confirmed that the security team took swift action. They blocked the fraudulent email address, informed those customers whose data had been affected, and escalated the issue to the relevant government agencies and enforcement bodies, including data protection organizations and financial regulators.
As the situation unfolded, independent crypto-security researcher ZachXBT issued a warning on September 12 via a post on Telegram, sharing a notification sent to customers by Revolut a day earlier. He asserted that sensitive user records had been illegally accessed during the breach. Reports indicated that the compromised data consists of deeply personal information, including full names, dates of birth, residential addresses, phone numbers, email addresses, and occupations. Moreover, copies of government-issued identification documents—such as passports and driver’s licenses—along with verification selfies were reportedly exposed.
The implications of the breach extend to financial data as well, with claims indicating that critical financial information, such as IBANs, account-opening dates, and detailed transaction histories, were also at risk. ZachXBT’s investigations prompted significant alarm among cybersecurity experts.
Muhammad Yahya Patel, a virtual Chief Information Security Officer (vCISO) and cybersecurity advisor at Huntress, raised essential questions regarding the breach. He commented on the expectations for a fintech company that relies heavily on digital identity verification, urging that the standards for confirming third-party data requests should be exceptionally high. Patel emphasized the need for a regulated financial institution, particularly one managing sensitive data, to possess rigorous verification controls capable of flagging such impersonation attempts.
The breach poses serious concerns for affected users, as experts warn that while Revolut claimed its systems and customer funds were safeguarded, the exposed information still creates vulnerabilities for identity theft and highly targeted phishing attacks. Jamie Akhtar, the CEO and co-founder of CyberSmart, echoed these sentiments, advising that the nature of the compromised data could serve as a “complete identity theft kit” for malicious actors.
Patel highlighted the breadth of sensitive information that has been compromised, stressing the severity of the situation. He noted that the exposed credentials and financial data not only surpass common data leak scenarios but indeed furnish an opportunistic thief with all the necessary tools to commit identity theft.
In light of these developments, affected customers have been urged to remain vigilant against unsolicited communications. Akhtar recommended heightened caution when confronted with unexpected calls, emails, or messages claiming to originate from Revolut, government agencies, or other trusted organizations. He advised individuals never to disclose passwords, passcodes, or one-time security codes and to engage with Revolut exclusively through its official app or verified website.
Akhtar also recommended that all users of digital financial services, regardless of their involvement in this breach, take proactive measures, such as enabling multi-factor authentication (MFA), utilizing unique passwords, and closely monitoring their financial accounts and credit reports for any irregular activity. Immediate reporting of suspected identity misuse is also highly encouraged.
The ripple effects of this incident highlight the pressing need for robust cybersecurity measures, especially within industries that handle sensitive data and financial transactions. As customers grapple with the ramifications of the breach, discussions about the adequacy of current security protocols and measures will undoubtedly intensify in the wake of this troubling incident.