Breaches and incidentsBriefReported by a reputable outlet, citing the company
Revolut: fake government data request sent from a real agency domain gets customers’ KYC documents and statements
Revolut told affected customers an attacker requested PII by email from a government agency’s domain and “it was fulfilled under the reasonable belief that...
- Disclosed
What happened
- Revolut told affected customers an attacker requested PII by email from a government agency’s domain and “it was fulfilled under the reasonable belief that it was an authentic government agency request.” Data: identity and contact details, passport or licence copies, KYC selfies, statements with IBANs, and transaction history including Bitcoin. “A limited number of customers”; ZachXBT says it appears targeted at high-net-worth users.
- Root cause: impersonated government data request (emergency/legal-process fraud) sent from an authenticated agency domain.
- No attacker named.
- Address blocked; agency, law enforcement, DPAs and financial regulators notified.
Sources
- https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
- https://www.cm-alliance.com/cybersecurity-blog/major-cyber-attacks-data-breaches-ransomware-attacks-september-2026
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.