Revolut Confirms Customer Data Breach Triggered by Fraudulent Government Domain Requests

Customer Data Compromised at Revolut

According to НВ — Техно: British fintech giant Revolut has acknowledged a breach of sensitive customer information caused by deceptive requests sent from an email domain impersonating a legitimate government agency. This security incident occurred before September 14, 2026, and according to company representatives, only a limited number of customers were affected, though the exact figure remains undisclosed.

The leaked data involved personal and contact details, including:

• birthdates
• mailing and email addresses
• phone numbers
• copies of passports and driver’s licenses
• identity verification selfies
• bank statements
• transaction histories

This breach was brought to light by cybersecurity researcher ZachXBT. A Revolut spokesperson explained that "the company recently uncovered a sophisticated fraud operation in which an unauthorized third party exploited a genuine government agency’s email domain to submit fraudulent data requests."

In response, Revolut has taken decisive action to prevent further data exposure, including blocking the fraudulent email address and notifying the relevant government bodies and law enforcement agencies. The company assures that "Revolut’s systems and customer funds remain secure at this time."

Revolut’s Growth and Regulatory Challenges

Founded in London in 2015 by Nikolay Storonsky and Vlad Yatsenko, Revolut now serves over 80 million customers across more than 30 countries. The firm is aggressively expanding its footprint in markets such as India, Mexico, France, and the United Arab Emirates. Additionally, Revolut has received a conditional approval from the U.S. Office of the Comptroller of the Currency to establish a national bank, with plans to launch in the first half of 2027.

However, in 2025, the European Central Bank restricted Revolut’s European division due to concerns over the rapid approval of new financial products. Though this regulatory limitation was not publicly disclosed, it was known to Revolut’s board as of July 2025. Prior to a stock sale, the company’s valuation was estimated at $75 billion.

This data breach presents a significant obstacle for Revolut amid its international expansion and preparations for launching a national bank in the U.S. Maintaining robust data security is critical for preserving customer trust, which is essential in the financial services industry. The fallout from this incident could impact Revolut’s reputation and its relationship with regulators, especially considering the prior restrictions imposed by the European Central Bank.