I will always sing the praises of Revolut for how they pressure traditional banks into innovation. However the world of finance and the world of “move fast and break things” probably shouldn’t meet so often. Revolut has been left with egg on its face after a very serious data breach, resulting in personal data of customers being handed over to bad actors. What’s worse is that, simply put, Revolut was asked for the data and they just obliged. Seems a little too easy, eh?
What is the Revolut data breach?
This week, Revolut confirmed it had disclosed sensitive customer data to an unauthorised third party after receiving a fraudulent information request that arrived from a genuine government agency’s email domain, carrying the authentication credentials that would normally mark it out as legitimate. The popular neo-bank has described the events as a “a sophisticated external impersonation scam” in which someone gained control of an email account operating inside a real government agency’s domain and used it to file bogus requests requests for information.
The request passed the checks Revolut normally relies on to establish that a government or law enforcement enquiry is genuine. The company hasn’t said which agency was impersonated, which country was involved, or how many customers were caught up in it.
What data is involved in the Revolut breach?
The notification sent to affected customers, and corroborated by CyberInsider’s own reporting, breaks the exposure into four categories.
- Identity details
- Full name
- Date of birth
- Occupation.
- Contact details
- Postal address
- Email address
- Phone number.
- Document and verification data
- Including a copy of a passport or driving licence
- Verification selfie taken at sign up
- Financial data
- IBANs
- Account status
- Opening date
- Wallet reference number
- Withdrawal records
- Complete transaction history
- Bitcoin activity.
Revolut says no biometric facial telemetry data was involved, but still, this is a treasure trove of personal data to hand over to bad actors.
Because the financial data handed over included full transaction histories, on chain activity is part of what’s exposed for some customers. Blockchain investigator ZachXBT, who first brought the notification to public attention, said the incident appeared to target customers with visible crypto wealth, as reported by Decrypt. The concern isn’t abstract. Once someone’s real name and address are linked to a public wallet, the risk shifts from online fraud to something that can turn up at your front door.
Does this touch Revolut’s Irish customers?
Revolut has around 3.4 million customers in Ireland, a figure that puts it in daily use across most of the country. Sources close to the ongoing investigation say approximately 680 customers have been impacted with 12 of those customers being based in Ireland.
The company hasn’t confirmed which markets were affected by this breach.
There is speculation online that the request Revolut received may have targeted only accounts with high net worth, so for once my crap bank balance might pay off for me here.
What Revolut has done to mitigate risk for customers?
Once the fraud was identified, Revolut blocked the email address, alerted the government agency whose domain had been used, and notified law enforcement, data protection authorities and financial regulators. It says it has contacted affected customers directly and put precautionary protections in place for them.
There are two reliable ways to find out if you’re affected, and everything else is guesswork. The first is the direct notification Revolut sends to anyone it believes was included. The second is a formal subject access request under GDPR Article 15, which any Irish customer can lodge to see exactly what data Revolut holds and has shared, following the Data Protection Commission’s guidance on subject access requests.
Not getting a notification doesn’t mean you’re in the clear. It just means nothing has landed in your inbox yet. Revolut advises that any customer with concerns should reach out to the company directly via their secure in-app chat.
Compromised data is appearing on Telegram
I’m reluctant to use the word hackers given they asked Revolut for data and got it, but will use the term purely because they must have hacked something, like the Government email to spoof Revolut, at some stage.
The “hackers” have apparently started releasing compromised data. They have reportedly said “we’re going to start releasing more and more data everyday until revolut pays for leaking their customers” on Telegram. If genuine, it would appear to support the reports that high value account holders were targeted, with tennis player Alexander Shevchenko and Gamdom CEO Felix Römer, CEO of online crypto casino Gamdom reported to be involved.
Why does Revolut keep all of this data in the first place?
A fair question, but one that has a genuine answer too. Financial instituions in Ireland, and in the UK, operate under a principle of Know Your Customer or KYC. KYC is an anti-money laundering effort where financial instituions must reach a baseline standardised knowledge of their customer. This is why, when creating an account with any instituion, you have to provide photo ID, utility bills and the likes of a verification selfie in a digital world.
When carrying out KYC, companies like Revolut are required to keep data on file for at least 5 years. This explains why they have it, but honestly, doesn’t fully explain how their own processes failed here. All accounts so far suggest that Revolut leaned heavily on automated processes and discovered what had happened when someone rang the Government agency in question. Unfortunately, that call allegedy happened after the data was already sent.
The DPC has responded today today to say there have been “no reports of breach currently”. Upon following up with the DPC later in the day, the DPC said there was still no further update nor was one expected given Revolut is headquartered in Lithuania.
Updated 14 September 2026: Added response from Revolut, updates that alleged customer data is appearing on Telegram and insight into why Revolut has this data in the first place. Added DPC response and follow up and updates on totall affected number of customers and customers in Ireland and guidance on what to do for concerned customers.
