LONDON, September 12 — Revolut has confirmed it suffered a data breach after someone impersonating a government agency obtained sensitive customer records, in an episode the London-based fintech and digital bank is calling an external impersonation scam. The attacker used an email address on the impersonated agency’s domain to extract the data, according to the bank. Revolut told TechCrunch that only a limited number of customers were affected and that it had contacted them directly.
The notification email sent to affected customers listed compromised data including birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licences. The bank also said verification selfies, account statements, and transaction histories may have been exposed.
Crypto investigator ZachXBT, who publicized the notice in a Telegram post, added several items Revolut left out of its notification: IBANs, withdrawal records, occupations, and transaction history covering bitcoin. He judged the incident limited in scale but aimed at high-net-worth users. Revolut said it blocked the sender’s address upon detecting the scheme and alerted the government agency concerned, law enforcement, data protection authorities, and financial regulators.
A spokesperson characterized the episode as an external impersonation scam and said the company’s systems and customer funds were untouched.
A pattern worth watching
The breach follows a pattern of impersonation attacks targeting financial institutions, where attackers pose as trusted entities to bypass technical controls. The involvement of cryptocurrency transaction data highlights the particular risks for users holding digital assets, as blockchain records are immutable and can be used to trace or target individuals. The incident raises questions about social engineering defenses at financial technology firms, the handling of high-value customer data, and the speed and transparency of breach notifications.
The bank’s confirmation and subsequent updates underscore the evolving nature of the threat and the challenges in protecting customer information. Watch this space.
What’s changing is the target profile — not the scale of the breach, but who the attackers are going after inside it.
