Revolut confirms data breach after threat actor impersonates government agency

Fintech platform Revolut has announced a data breach resulting from the unauthorized disclosure of customer information to a malicious actor who posed as a government agency representative.

Operating across more than 160 countries and territories, Revolut serves over 80 million customers globally, with an additional 800,000 business accounts on its platform. The company provides banking, money transfer, and investment capabilities to this user base.

According to notifications sent to impacted customers, the attacker obtained access by sending requests through email using a government agency's legitimate domain. Revolut explained that "As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request."

The compromised dataset encompasses several categories of sensitive information. Identity-related data included full names, birthdates, and occupational information. Contact details such as mailing addresses, email accounts, and phone numbers were also exposed. Additionally, verification materials were accessed, including scanned copies of identity documents like passports and driver's licenses, along with facial recognition images captured during account verification procedures.

Financial records constituted another significant portion of the breach. Stolen data included account statements with associated IBAN numbers, withdrawal transaction records, and comprehensive transaction histories spanning all account activity, including cryptocurrency transactions.

Revolut stated that the breach affects a restricted customer segment but declined to disclose the specific number of affected individuals. A company representative told BleepingComputer: "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators. Revolut systems and customer funds are unaffected."

Security researcher ZachXBT, who specializes in cryptocurrency fraud investigation, suggested over the weekend that despite the limited scope of affected customers, "it seems to have been targeted at high net worth users."

This incident marks the second significant breach for Revolut in recent years. In 2022, the company disclosed a separate breach in which attackers compromised the personal, contact, and financial records of 50,150 customers during September of that year.