Fintech firm Revolut disclosed that an unauthorized third party accessed customer data by impersonating a government agency via email.
Key facts
- •Revolut confirmed an unauthorized third party used a legitimate government email domain to request customer data.
- •Exposed data includes identity documents, contact details, and potentially transaction histories.
- •Revolut has not disclosed the specific number of affected customers or the government agency involved.
- •Crypto security researcher ZachXBT reported that the incident appeared to target high net worth users.
- •Revolut operates globally with over 80 million customers.
British fintech company Revolut has confirmed that sensitive customer information was exposed to an unauthorized third party. The breach occurred after the company received fraudulent requests for information sent from a legitimate government agency email domain.
Scope of the Data Exposure
The exposed information includes customer identity and contact details such as birth dates, postal and email addresses, and phone numbers. Additionally, the breach involved copies of identity documents, including passports and driver’s licenses. Revolut stated that verification selfies, account statements, and transaction histories may also have been accessed.
Company Response and Security Status
Revolut stated that it has blocked the email address used in the scam and notified law enforcement, regulators, and the relevant government agency. The company confirmed that a limited number of customers were affected and that it has contacted those individuals directly. Revolut emphasized that its internal systems and customer funds remain unaffected by the incident.
Advertisement
This article was independently rewritten by ManyPress editorial AI from reporting originally published by TechCrunch.
