Global financial technology giant Revolut has confirmed a sophisticated data breach where unauthorized actors managed to access sensitive customer information. The breach occurred after attackers successfully impersonated a legitimate government agency, utilizing an official email domain to submit fraudulent requests for information. Upon discovering the deception, Revolut immediately blocked the compromised email address and notified law enforcement, regulators, and the affected government entity.

The compromised data includes highly sensitive personal details such as names, dates of birth, physical and email addresses, phone numbers, and copies of government-issued identification documents like passports and driver’s licenses. In some instances, verification selfies, account statements, and transaction histories may have also been exposed. While Revolut has not disclosed the exact number of affected individuals or the specific regions impacted, the company stated that a “limited” number of customers were targeted and have been contacted directly. Independent security analysts suggest the breach specifically targeted high-net-worth accounts.

Revolut has reassured its user base that its core internal systems and customer funds remain completely secure and unaffected by the incident. Headquartered in London, the fintech powerhouse boasts over 80 million customers worldwide and holds banking operations in more than 30 countries. The company has been aggressively expanding its global footprint, recently securing conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank in the United States, with a projected launch in early 2027.

This security setback comes at a critical juncture for Revolut as it positions itself for a highly anticipated public listing. The company is reportedly eyeing an initial public offering (IPO) that could value the firm at up to $200 billion, a massive leap from its previous $75 billion private valuation. While the firm has recently secured key banking licenses in major European markets like the United Kingdom and France, maintaining robust cybersecurity defenses will be paramount to preserving investor confidence ahead of its market debut.

Key Takeaways

• Revolut fell victim to a sophisticated social engineering attack where hackers used a legitimate government email domain to request sensitive customer data.
• Exposed information includes customer IDs, selfies, contact details, and transaction histories, with reports indicating high-net-worth users were the primary targets.
• The breach occurs as Revolut prepares for a potential $200 billion IPO and expands its banking operations globally, including a planned U.S. launch in 2027.

Editor’s Analysis & Impact

This breach highlights a growing and highly dangerous trend in cybercrime: the weaponization of legitimate government communication channels. By exploiting trusted government email domains, attackers bypass traditional phishing filters and exploit the compliance-oriented protocols of financial institutions. For Revolut, the timing of this incident is particularly sensitive. As the fintech giant seeks a blockbuster public valuation of up to $200 billion and works to secure regulatory trust in the U.S. and Europe, any perceived vulnerability in data protection could invite stricter regulatory scrutiny and dampen investor enthusiasm. To mitigate long-term reputational damage, Revolut must demonstrate not only robust technical defenses but also enhanced verification protocols for external regulatory requests. This incident serves as a stark reminder to the entire fintech sector that security is only as strong as the verification processes governing external communications.

Frequently Asked Questions

Q: How did the attackers gain access to Revolut's customer data?
A: The attackers used a sophisticated impersonation scam, sending fraudulent data requests from a legitimate government agency's email domain, which misled Revolut into disclosing the information.

Q: Were customer funds stolen or compromised during this breach?
A: No. Revolut has confirmed that its core systems and customer funds remain completely secure and were unaffected by this incident.

Q: Who was affected by this data breach?
A: Revolut stated that a limited number of customers were impacted and have been notified directly. Security researchers indicate that the attack appeared to specifically target high-net-worth individuals.