Revolut Confirms Data Breach Following Sophisticated Government Impersonation Scam

London-based fintech giant Revolut has confirmed a significant security breach involving the unauthorized disclosure of sensitive customer information. The incident occurred after an external party successfully impersonated a legitimate government agency, using an authentic email domain to submit fraudulent requests for user data. The company has since blocked the compromised email address and initiated notification procedures for the affected individuals.

The exposed data set is extensive, encompassing personal identifiers and contact information. According to notifications sent to customers, the compromised details include birth dates, postal and email addresses, and phone numbers. Furthermore, the breach involved copies of official identity documents such as passports and driver's licenses. In some instances, the unauthorized party may have accessed verification selfies, account statements, and transaction histories. Revolut has maintained that its core internal systems and customer funds remain unaffected by the intrusion.

The breach was characterized by the company as a sophisticated external impersonation scam. By leveraging a legitimate government agency domain, the attackers bypassed standard verification filters that might otherwise have flagged an external request as suspicious. While Revolut has not disclosed the specific government body targeted or the exact number of customers impacted, the company emphasized that the breach affected only a limited segment of its global user base.

Security researcher ZachXBT, who first brought attention to the incident, noted that the targeting appeared to focus on high-net-worth individuals. This suggests a calculated effort by the attackers to gain access to accounts with potentially higher financial stakes. Revolut has confirmed that it has alerted relevant law enforcement, data protection authorities, and financial regulators regarding the incident, fulfilling its mandatory reporting obligations under various international data protection frameworks.

Revolut currently serves more than 80 million customers across more than 30 countries. The company has been in a period of aggressive global expansion, recently entering markets such as India, Mexico, France, and the UAE. This incident arrives at a critical juncture for the firm, which is currently navigating the complexities of scaling its banking operations. Earlier this month, the U.S. Office of the Comptroller of the Currency granted the fintech conditional approval to establish a national bank in the United States, with a projected launch date in the first half of 2027.

The company has also been working to solidify its regulatory standing in Europe, having secured banking licenses in both the UK and France in recent months. These licenses are central to its strategy of transitioning from a digital payments provider to a full-service banking institution. The security breach, while limited in scope, presents a reputational challenge as the firm seeks to maintain the trust of regulators and customers in these new, highly regulated markets.

The timing of the breach is particularly sensitive given Revolut's reported preparations for a potential public listing. Industry analysts have suggested the company could be valued at as much as $200 billion, a substantial increase from its $75 billion private valuation recorded in November. A successful IPO of this magnitude would require significant investor confidence in the company's internal controls and data security infrastructure.

While the company has stated that its systems and customer funds are secure, the incident highlights the persistent threat posed by social engineering and impersonation attacks. As fintech firms increasingly rely on digital verification processes to onboard customers and manage accounts, the vulnerability of these communication channels remains a primary concern for the industry. The ability of an unauthorized party to successfully mimic a government agency underscores the need for more robust verification protocols for all incoming official requests.

The broader fintech and AI sectors are currently grappling with heightened scrutiny regarding data handling and security. The incident at Revolut follows a pattern of increasingly sophisticated attacks targeting the intersection of government communication and private sector data repositories. As companies like Revolut expand their footprint, the surface area for such attacks grows, necessitating constant updates to security architecture and employee training.

Regulators are expected to monitor the situation closely to determine whether the breach resulted from systemic failures in Revolut's verification processes. The company's immediate response, including blocking the fraudulent email address and notifying authorities, aligns with standard incident response protocols. However, the long-term impact on the company's valuation and its ability to secure further regulatory approvals will depend on the transparency of its investigation and the effectiveness of its remedial measures.