Revolut Data Breach Affects 680 Customers After Fake Government Request

Highlights:

• Revolut warned 680 customers after scammers used a real government email account to request their personal information.
• The exposed data included identity documents, bank details, home addresses and Bitcoin activity from some customers.
• The UK privacy watchdog is investigating, while Revolut says customer funds and its systems were not affected.

Digital banking and fintech company Revolut has notified 680 customers after scammers tricked it into sharing sensitive personal and financial information through a fraudulent government request. The exposed records included identity documents, bank account details, home addresses and Bitcoin activity linked to some customers.

The Financial Times reported the number of affected customers on September 14, citing people familiar with Revolut’s initial investigation. The incident happened after an attacker gained access to a legitimate government email account and used it to request private customer information from Revolut. The request appeared genuine because it came from an authentic government agency domain. Revolut responded and provided information connected to the customers named in the requests.

FT: Revolut Gave Hackers Data on 680 Customers After Fake Government Requests

Revolut disclosed sensitive data on 680 customers after cybercriminals used a legitimate government email account to submit fraudulent information requests, the Financial Times reported. The exposed… pic.twitter.com/yfMmCwSAtM

— Wu Blockchain (@WuBlockchain) September 15, 2026

Revolut Shared Identity and Bitcoin Records

The information handed over included passport details, bank account numbers, residential addresses, identity cards and verification images. Records showing Bitcoin activity were also among the data disclosed. Attackers claiming responsibility have since threatened to publish the stolen information unless Revolut pays a ransom. There is no confirmation that the company plans to meet that demand.

Revolut said the incident was an external impersonation scam rather than a direct breach of its internal systems. According to the company, an unauthorized party used a legitimate government agency email account to submit fraudulent information requests. Once Revolut discovered the issue, it blocked the email address and contacted the customers involved. The company also notified regulators and stressed that customer funds and its own systems were not affected.

The distinction is important because the attackers did not need to break into Revolut’s banking infrastructure to obtain the information. Instead, they exploited the process used to handle requests that appeared to come from government authorities.

UK Privacy Regulator Investigates Revolut Incident

The UK’s Information Commissioner’s Office, or ICO, has opened an investigation after Revolut reported the incident. The watchdog confirmed its investigation on September 14. Former Mt. Gox CEO Mark Karpelès is among the customers affected. Karpelès said Revolut emailed him on September 12 to warn that his personal information may have been exposed.

He later questioned why the information had been released based on the authenticity of the government email account. In his view, Revolut should not have provided the records even if the request came through a verified government address. The case has attracted additional attention in the crypto industry because some of the compromised information included Bitcoin activity. Such records can reveal details about a customer’s cryptocurrency transactions alongside traditional financial and identity data.

Revolut Contacts Customers as Investigation Continues

Revolut has grown into one of Europe’s largest fintech companies since launching in 2015. The company now serves around 80 million customers across 30 countries, according to the report. The 680 accounts identified so far represent a small portion of that global customer base. However, the investigation now centres on how fraudulent requests passed verification checks despite involving highly sensitive financial and identity information.

Revolut says its systems remain secure, and customer funds were not affected. The company has contacted the customers identified in its investigation, while the ICO continues reviewing the circumstances surrounding the disclosure.