The Revolut data breach began with fraudulent information requests sent from a legitimate government agency’s email domain. The fintech company confirmed that it treated the requests as authentic and disclosed sensitive records to an unauthorized party before discovering the deception.

The incident did not require attackers to penetrate Revolut’s banking systems. Instead, it exploited the trust placed in an official-looking government channel, exposing a difficult weakness at the intersection of law-enforcement cooperation, identity verification and customer privacy.

Revolut’s disclosure establishes four key facts:

• The requests came through a real government domain.
• The sender was not authorized by that agency.
• A limited but undisclosed number of customers were affected.
• Revolut says customer funds and its systems were unaffected.

Related Research

• Visa Launches Know-Your-Agent Framework With Mastercard and Ant
• Anthropic Disrupts Claude Misuse Across Weapons and Espionage

Revolut Confirms the Data Breach

Reuters reported on September 12 that Revolut disclosed customer information after receiving fraudulent requests from an email account created inside a genuine government agency domain. Because the messages carried valid domain authentication, they appeared to originate from the authority.

Revolut described the episode as a sophisticated external impersonation attack. The company said it blocked the sender after identifying the problem and notified the relevant government agency, law enforcement, data-protection authorities and financial regulators.

The company also contacted the affected customers directly. Revolut has not publicly named the government agency, identified the country involved or disclosed how many people were included in the responses, leaving the breach’s precise scale unknown.

That missing information matters. Without a customer count, incident date or jurisdiction, outsiders cannot yet assess whether the episode was a narrowly targeted operation or part of a broader campaign using compromised government infrastructure.

Identity Documents and Transaction Records Were Exposed

Customer notifications reviewed by multiple publications show that the exposed material could extend well beyond basic contact details. The Block reported that potentially disclosed records included identity documents, verification images and detailed account activity.

The listed categories included names, dates of birth, postal and email addresses, telephone numbers, passports or driving licences, verification selfies, account statements and international bank account numbers. Withdrawal records and full transaction histories, including Bitcoin transactions, were also among the data described in notices.

Revolut said its systems and customer funds were unaffected. That distinction means the confirmed event was an unauthorized disclosure through a trusted request process, not evidence that an attacker obtained direct access to the company’s core banking platform.

For affected customers, however, the absence of stolen funds does not eliminate risk. Identity documents, contact information and financial histories can be combined to create convincing phishing messages, impersonate support personnel or target individuals with knowledge of their actual accounts and transactions.

A Trusted Domain Defeated a Human Verification Process

The Revolut data breach highlights a security problem that ordinary email authentication cannot solve. Technologies that verify a message came from an authorized server can help detect spoofed domains, but they do not prove that the person controlling an authenticated mailbox is a legitimate government official.

An attacker who obtains or creates an account inside a government domain inherits much of that domain’s credibility. If a financial institution’s review depends heavily on the sender address and valid authentication records, a technically genuine email can still carry a fraudulent request.

Government data demands require a stronger chain of trust. Effective controls can include independently verified agency contacts, case-number validation through a separate channel, role-based approval for sensitive disclosures and additional scrutiny when requests seek identity documents or complete transaction histories.

The same principle applies beyond banking. Telecommunications companies, cloud providers and social platforms routinely handle official requests for private data, making verification failures at any provider valuable to criminals seeking information without breaching the provider’s network.

Regulators Will Examine Revolut’s Disclosure Controls

Revolut’s notifications to data-protection and financial regulators begin a process that could test whether its procedures matched the sensitivity of the information disclosed. Investigators will likely focus on how the requests were authenticated, which approvals were required and how quickly the company detected and contained the problem.

The company’s description of a limited group reduces the apparent scale but does not answer the central control question. A small, targeted disclosure can be serious when it includes identity documents and detailed financial activity, especially if the victims were selected rather than caught in a broad, indiscriminate breach.

Revolut has not publicly said whether the unauthorized party retained, shared or used the records. It also has not disclosed whether similar requests reached other institutions through the same agency domain, an issue that could expand the incident beyond one company.

The next credible updates will come from regulator findings, a fuller company incident report or evidence about the compromised government account. Until then, the confirmed lesson is narrower but consequential: valid email credentials cannot substitute for independently verifying who is asking for sensitive customer data.