Overview
- Revolut told customers it released identity and account records after fulfilling a request that appeared to come from a government agency because the message carried valid domain authentication.
- The company’s notice lists disclosed items as full names, dates of birth, contact details, copies of identity documents and verification selfies, account statements, IBANs, withdrawal records, full transaction histories and Bitcoin wallet reference numbers.
- Revolut’s notice does not name the agency, state when the request arrived, quantify how many customers were affected, or say whether regulators have been notified, and claims that wealthy users were targeted remain unconfirmed.
- The firm said the incident involved an unauthorized account using an official agency domain rather than an internal system breach, and it did not report that wallet private keys, account passwords or full payment card details were disclosed.
- The exposure puts affected customers at risk of identity theft or fraud and could prompt regulator scrutiny and reputational damage for Revolut as it expands crypto services and pursues U.S. banking approval.