Revolut discovered that a fraudulent government information request passed through its security checks, resulting in the exposure of sensitive customer data. The attacker obtained personal identification details, addresses, contact information, verification documents, account statements, and full transaction histories, including Bitcoin activity.
The phishing attack targeted Revolut's internal process for handling official government data requests. The attacker created an unauthorized email account within an official government authority's domain infrastructure and included genuine domain authentication credentials, leading Revolut to fulfill the request believing it was legitimate.
According to Revolut, the request carried valid technical authentication, which caused the company's security checks to treat it as an authentic government agency request. After discovering the fraud, Revolut blocked the attacker and notified affected customers and regulators.
The compromised data included names, addresses, contact details, government-issued IDs, verification selfies, IBANs, account statements, and withdrawal records. The exposure of this information linked to Bitcoin transaction histories is particularly sensitive because while Bitcoin transactions are publicly recorded, wallet addresses are typically not directly connected to real identities. Security researcher ZachXBT suggested the breach may have targeted high-net-worth customers, though Revolut has not confirmed the specific number or profile of affected users.
The incident occurred following the Office of the Comptroller of the Currency's conditional approval of Revolut's application to establish a U.S. national bank, pending additional regulatory approvals from the FDIC and Federal Reserve.
