Data Leak: “Revolut’s Systems and Our Customers’ Funds Were not Affected”

Set Trending Topics as a preferred source on Google.

After the Revolut data breach came to light, in which unknown actors obtained sensitive customer data through forged government requests, the fintech has now issued a detailed statement. Its core message: the Revolut app, its systems and its databases remain secure and were never hacked. Access, the company says, ran solely through the detour of manipulated information requests.

The data package that leaked is a broad one: names, dates of birth and occupations, postal and email addresses as well as phone numbers. On top of that come copies of passports and driver’s licenses, along with the selfies Revolut requires for identity verification. Bank statements, full transaction histories, IBANs and Bitcoin transaction data are reportedly affected as well. In effect, the attackers hold the complete KYC profile of everyone involved.

Revolut Cites a ‘Sophisticated External Fraud Attempt’

“Revolut recently identified a sophisticated external fraud attempt in which an unauthorized third party used a legitimate email domain belonging to a government agency to submit fraudulent information requests,” the statement reads, which the company says reflects the current state of its investigation. “Upon discovery, we immediately blocked the address in question and informed the relevant government agency as well as law enforcement, data protection and financial supervisory authorities.”

It continues: “Revolut’s systems and our customers’ funds were not affected. We have contacted the affected individuals, whose number is limited, directly in order to inform and support them.”

680 People Affected, With a Trail Leading to Italy

Revolut leaves the exact number of affected customers open in its statement. According to a report by upday, 680 users are involved. The requests are said to have come from the email addresses of an Italian government agency, whose legitimate domain lent them an air of officialdom. That figure matches other reports, which likewise put the count at just under 700 people.

The attackers have announced on Telegram that they will keep publishing further data for as long as Revolut refuses to pay. Identity documents and selfies from the KYC process have already been put online. Among the affected people known so far are former Mt. Gox chief Mark Karpelès and Gamdom CEO Felix Römer.

This is the second security incident of its kind for Revolut. Four years ago, unknown actors used social engineering to gain access to the data of roughly 50,150 customers, about 0.16 percent of its user base at the time. That breach covered names, addresses, phone numbers, email addresses and limited payment card data, while PINs, passwords and full card details stayed out of reach. A phishing wave rolled over the affected accounts soon after, and Lithuania’s data protection authority opened an investigation.

Reddit User Claims to Have Lost 50,000 Euros in Bitcoin

A post in the Revolut subreddit has added to the commotion. One user writes there that he lost Bitcoin worth around 50,000 euros in the course of the incident and intends to seek damages from Revolut. He says he plans to close his account.

Asked about it, Revolut says only that it does not comment on individual cases as a matter of policy. Whether individual customers suffered actual financial losses, and on what scale, therefore remains open for now. The company points to the fact that customer funds within its own systems are untouched.

Why This Attack Pattern Is So Dangerous

The case exposes an attack surface that technical safeguards alone can barely close: banks and fintechs are legally required to respond promptly to information requests from government authorities. Anyone who controls a genuine government domain can exploit that reflex. Emergency data requests of this kind have surfaced as an entry point repeatedly in recent years, including at large US tech companies.

The risk for those affected persists even where funds stayed in place. Identity documents, selfies, IBANs and full transaction histories are enough to build identity theft schemes and tailor-made phishing attacks. Security researchers advise affected customers to stay especially alert to calls or emails supposedly “from Revolut” and to review two-factor authentication on every linked account.