Revolut Data Breach Exposes Customer Passport Copies and Transaction Histories
Financial technology firm Revolut has disclosed a data-security incident where sensitive customer information, including passport copies and transaction histories, was exposed via a fraudulent request impersonating a government agency.
Financial technology giant Revolut has revealed a significant data-security incident that led to the exposure of sensitive customer information, including Know Your Customer (KYC) documents and detailed transaction histories. The breach occurred not through a compromise of Revolut's core systems or customer accounts, but via a sophisticated social-engineering attack. Threat actors successfully impersonated a legitimate government agency, submitting a fraudulent request that, due to valid domain-authentication credentials, was mistakenly fulfilled by Revolut.
The exposed data is highly sensitive and includes full customer names, dates of birth, occupations, postal addresses, email addresses, and telephone numbers. More critically, copies of identity documents such as passports and driver's licenses, along with facial-verification images submitted during the onboarding process, were also disclosed. While Revolut stated that biometric facial telemetry was not involved, the loss of these documents poses substantial risks for identity theft and impersonation.
Beyond identity documents, the incident also compromised extensive financial records. This included account statements with IBANs, account status, opening dates, wallet reference numbers, withdrawal records, and complete transaction histories. Notably, the exposure of cryptocurrency transaction records, including Bitcoin activity, could provide attackers with detailed insights into users' financial behavior, wealth, and potential vulnerabilities for targeted scams.
Revolut has characterized the event as a social-engineering attack rather than a breach of its internal infrastructure. The company claims to have acted swiftly by blocking the unauthorized email source, notifying relevant authorities, and contacting affected customers. Revolut also emphasized that customer funds remain secure and its systems were not compromised.
However, the incident has reignited concerns about the security of mandatory KYC data collection practices across financial institutions, fintech platforms, and cryptocurrency services. On-chain investigators and cryptocurrency community figures have pointed out that the attack may have targeted high-net-worth individuals, a demographic particularly vulnerable to sophisticated phishing, SIM-swapping, extortion, and tailored cryptocurrency theft attempts.
The combination of compromised identity documents, personal contact details, account information, and transaction history provides attackers with a potent toolkit for crafting convincing social-engineering lures. Fraudsters could impersonate Revolut support, law enforcement, exchanges, or tax authorities, using the stolen personal data to lend credibility to their schemes.
This incident also highlights a critical vulnerability in how organizations handle information requests. Even when requests appear to come from authenticated email domains, the sender account itself may be unauthorized. The case underscores the necessity for organizations handling sensitive customer data to implement robust, out-of-band verification processes for high-risk information requests, rather than relying solely on sender identity or domain authentication.
The implications extend to the broader financial and regulatory landscape, potentially leading to increased scrutiny of data handling practices and security protocols within the fintech sector.
The new article provides additional details on the data exposed, including the potential exfiltration of verification selfies, account statements, and transaction histories, which were not explicitly mentioned in the initial report. Furthermore, it highlights that crypto investigator ZachXBT identified that IBANs, occupations, and Bitcoin transaction histories may have also been compromised, and suggests the attack may have targeted high-net-worth users.
The new reporting details the specific social engineering tactic employed: threat actors used a legitimate government agency domain email to submit fraudulent data requests, which were then fulfilled by Revolut employees due to valid technical domain authentication. Experts are questioning the verification controls in place at the fintech firm, given the sensitive nature of the data compromised, which included full names, addresses, passport copies, and transaction histories, forming what one expert called a "complete identity theft kit."
The new reporting indicates that the fraudsters specifically targeted high-net-worth individuals, many involved in cryptocurrency businesses, and that the fraudulent requests may have originated from an Italian government domain. While Revolut has confirmed blocking the compromised email address and alerting authorities, the Telegram account claiming responsibility has since been suspended, and some of the alleged extortion details could not be independently verified.
The incident involved a social engineering attack where threat actors impersonated a government agency using a fraudulent request from a legitimate government domain. While the previous report focused on the types of data exposed, this disclosure clarifies that the attackers did not breach Revolut's systems directly but rather tricked the company into handing over sensitive customer information, including identity documents and financial statements, through a deceptive request.
The fintech company has confirmed that the breach occurred due to a sophisticated external impersonation scam where an unauthorized third party used a legitimate government agency domain email to submit fraudulent requests for information. Revolut has since blocked the attacker's email and notified relevant authorities and regulators. While customer systems and funds remain unaffected, the company is directly contacting the limited number of impacted individuals to offer support.
Revolut has disclosed that the data breach occurred due to a sophisticated social engineering attack. Attackers successfully impersonated a government agency by using a spoofed email address, which led the financial platform to inadvertently disclose sensitive customer information. This incident highlights the persistent threat of impersonation scams targeting corporate entities.
The new article provides further technical detail on the Revolut data breach, explaining that the attacker did not exploit the app or core banking infrastructure but instead abused trust in an apparently authentic government communication. It highlights that while email authentication methods like SPF, DKIM, and DMARC can verify a domain's legitimacy, they do not confirm the identity of the sender or the lawfulness of the request itself, especially if an attacker gains access to a legitimate agency account. The article also notes that while Revolut has not disclosed the number of affected customers, the government agency whose domain was abused, or the duration of the activity, claims from a threat actor suggest the operation may have lasted six months and involved 147 GB of Italian-side material.
The threat actor known as 'IAmNotAVillain' has publicly demanded a $3 million ransom from Revolut, threatening to sell the compromised customer data. However, Revolut has stated they have not received any direct contact or demands from the alleged perpetrators, indicating a potential disconnect between the public claims and direct communication with the company.
Following the Revolut data breach, customers are now receiving sophisticated phishing text messages that mimic legitimate bank communications. These messages, appearing in the same conversation thread as authentic Revolut texts, direct users to fake login pages that request camera access and attempt to replicate identity verification processes, potentially aiming to steal credentials and compromise accounts.
Following the initial disclosure of the Revolut data breach, threat actors have launched a new wave of sophisticated phishing attacks targeting customers. These smishing messages, which appear in existing conversation threads to seem legitimate, urge users to click links to confirm their identity or face account restrictions. The phishing pages have been observed to request camera access for a fake identity verification, potentially allowing attackers to capture selfies or videos for further social engineering and account hijacking.