Revolut falls victim to spoofed agency email, suffers data breach

British fintech giant and neobank Revolut disclosed a significant data security incident after threat actors impersonated a legitimate government agency by using a fraudulent email domain to request sensitive information.

 

Revolut is a London-headquartered digital financial platform and app-based neobank that lets users spend, send, and manage money globally. It offers multi-currency accounts, competitive FX rates, debit cards, budgeting and savings tools, and investment options. Depending on the country, it operates as a licensed bank or financial service, with free and paid plans offering additional benefits.

 

Recently, Revolut started notifying its customers of a data security incident after the company exposed customer data to a third party following fraudulent requests from a spoofed government email.

 

 

“As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request,” the company said.

 

According to reports, the confidential information shared with the perpetrators comprised extensive personal and financial data, including names, dates of birth, occupations, residential addresses, email addresses, and phone numbers. The information also reportedly included copies of identity documents, such as passports and driver’s licences, along with facial verification images. In addition, sensitive financial records—including IBANs, account statements, withdrawal records, and complete transaction histories, including Bitcoin transactions—were reportedly exposed.

 

In a statement shared with TechCrunch, a Revolut spokesperson said a small number of customers were affected. The company added that it blocked the email address after detecting the scam, notified the relevant authorities and regulators, and said, “Revolut systems and customer funds are unaffected.”

 

Social media reports indicate that the hackers behind the Revolut phishing attack are leaking sensitive customer data, including records belonging to high-profile figures like tennis player Shevchenko and Gamdom/Skinscom CEO Römer.

 

 

The perpetrators are now demanding a ransom from Revolut, threatening to leak additional internal communications, data, and operational insights. They also claim that Revolut compromised user privacy through negligence and illegally transferred sensitive information to foreign jurisdictions.