Revolut Confirms Customer Data Breach Linked to Fake Government Requests

Revolut has confirmed that sensitive customer information was disclosed to an unauthorised third party after fraudulent information requests were sent from a legitimate government agency email domain.

The exposed information included identity and contact details such as dates of birth, postal addresses, email addresses and phone numbers. Revolut said affected records may also have contained passport or driver’s license copies, verification selfies, account statements and transaction histories.

The fintech did not disclose how many customers were affected, whether the incident was limited to a particular market or which government agency’s email domain was used.

Fraudsters impersonated a government authority

Revolut described the incident as a sophisticated external impersonation scam in which an unauthorised party used a legitimate government agency domain to submit fraudulent requests for customer information.

Crypto security researcher ZachXBT drew attention to the breach after sharing details from Revolut’s notification to affected customers. ZachXBT said the incident appeared to have targeted high-net-worth users.

Revolut has more than 80 million customers worldwide and operates as a bank in more than 30 countries, according to the company’s corporate information. Its international footprint has recently expanded across markets including India, Mexico, France and the United Arab Emirates.

Revolut continues global banking expansion

The breach comes as Revolut pushes deeper into regulated banking markets. Earlier this month, the U.S. Office of the Comptroller of the Currency granted the company conditional approval to establish a U.S. national bank, which Revolut expects to launch in the first half of 2027.

The company has also recently secured banking licenses in France and the U.K. as it expands its international operations.

Separately, Revolut is reportedly considering a potential public listing that could value the company at as much as $200 billion. That would represent a substantial increase from its reported $75 billion private valuation in November.

The incident exposes a different kind of security risk for financial companies: attackers do not necessarily need to compromise a bank’s internal systems if they can successfully impersonate a trusted government authority and persuade employees or processes to release customer information.