What we know about the Revolut data breach so far

Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank confirmed the incident on Saturday, September 12.

The London-based fintech told TechCrunch that a limited number of customers were affected and that it had contacted them directly.

The notification Revolut emailed affected customers listed birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licences. Verification selfies, account statements and transaction histories may also have gone out, the bank said.

ZachXBT, the crypto investigator who publicized the notice in a Telegram post, added several items Revolut left out: IBANs, withdrawal records, occupations, and transaction history covering bitcoin. He judged the incident limited in scale but aimed at high-net-worth users.

Revolut said it blocked the sender’s address on detecting the scheme and alerted the government agency concerned, law enforcement, data protection authorities and financial regulators. A spokesperson characterized the episode as an external impersonation scam and said the company’s systems and customer funds were untouched.