Revolut Says Attacker Impersonating a Government Agency Accessed Customer KYC Data
The company says a third party used a legitimate government email domain to request account and identity records, and that customer funds and core systems were not compromised.
LONDON — Revolut has disclosed that a third party obtained sensitive customer data by impersonating a government agency, sending information requests from what the company describes as a legitimate government email domain that passed its standard authentication checks. The disclosure puts Revolut in the position many fintechs and banks have faced in recent years: a breach that originated not through a technical exploit of internal systems, but through a request that appeared to come from a trusted institutional source.
According to Revolut's account, the data exposed includes "know your customer" identity-verification material — passports, driver's licenses and verification selfies collected during onboarding — along with full names, dates of birth, contact details, account statements, IBANs and complete transaction histories, including records of Bitcoin activity. That combination of identity documents and financial history is the profile most useful to fraudsters attempting account takeover or identity theft elsewhere, which is what makes a KYC-data breach distinct in severity from, say, a leaked email list.
Revolut has said that its systems and customer funds were not compromised, framing the incident as a data-exposure event rather than a breach of the ledger or payment infrastructure itself, and that it is notifying affected customers directly. The company has not disclosed, at least as described in current reporting, the total number of customers affected or the specific government agency whose email domain was spoofed or otherwise used to authenticate the request.
The mechanism described — a request that passed standard security authentication because it came from an authentic institutional domain — is a reminder that identity-verification programs designed to satisfy regulators can themselves become an attack surface: the same KYC files that let a bank prove compliance are a single high-value target if the process for releasing that data to a requesting authority does not distinguish carefully between a legitimate request and a spoofed one. For Revolut, a company that has spent years working toward full banking licenses across multiple jurisdictions, an incident that touches its identity-verification pipeline lands closer to the core of its regulatory relationships than a more contained technical breach would have.
What happens next for affected customers depends largely on details Revolut has not yet made public: how many people's documents were exposed, whether any regulator has opened a formal inquiry, and whether the company will offer credit-monitoring or identity-protection services as a remedy, as is now standard practice following breaches of this type at other financial institutions.