Revolut has confirmed that an attacker successfully impersonated a government agency to obtain sensitive customer information. According to the company, an unauthorized third party used a legitimate government agency email domain to submit fraudulent data requests, which Revolut processed before detecting the breach.
The compromised customer records included passports, driving licenses, home addresses, bank statements, and complete Bitcoin transaction histories. Revolut stated that login credentials, passcodes, and biometric facial templates were not exposed, and no customer funds were moved.
A Revolut spokesperson described the attack as sophisticated, noting that the company blocked the sender immediately upon discovery. The bank has notified the relevant government agency, police, financial regulators, and data protection authorities. Revolut said it contacted the limited number of affected customers.
The company declined to identify which government agency's email domain was compromised, citing an ongoing police investigation. This leaves unclear whether a government mailbox was hijacked or whether the fraudulent request originated from within the agency itself.
Blockchain investigator ZachXBT highlighted the breach and noted that the stolen data appeared to target a small group of users, possibly wealthy customers. The exposed information poses particular risks, as stolen customer lists have historically been used for phishing attacks and targeted harassment of cryptocurrency holders.
