Revolut has confirmed it has suffered a data breach that has affected customers.

Speaking to Infosecurity on September 14, a Revolut spokesperson said an unauthorized third party submitted “fraudulent requests for information” using a “legitimate government agency domain email”.

Revolut described the technique as “a sophisticated external impersonation scam” that led it to disclosing sensitive information to the threat actor.

The requests made by the threat actors carried valid technical domain authentication and were fulfilled by Revolut employees as standard legal compliance.

The British fintech firm said only a “very limited group of customers” were affected by the data breach, adding that its systems and customer funds were untouched.

The company declined to comment further on the number of affected customers or whether the breach affected any specific market or department.

A Revolut spokesperson said its security team “immediately blocked the address” upon detection, notified affected customers and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators.

Sensitive Customer Records Exposed as Experts Question Verification Controls

On September 12, independent crypto-security researcher ZachXBT issued a warning about the breach via a post on Telegram, sharing a customer notification sent out by Revolut the previous day and disclosing that sensitive user records had been improperly accessed.

The compromised data reportedly includes full names, dates of birth, residential addresses, phone numbers, email addresses and occupations, along with copies of government ID documents (such as passports and driver's licenses) and verification selfies.

Additionally, ZachXBT claimed that financial information was exposed, including IBANs, account-opening dates, complete transaction and withdrawal histories and Bitcoin wallet reference numbers.

Commenting on the breach, Muhammad Yahya Patel, vCISO & cybersecurity advisor at Huntress, noted: “For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high. The question is: why a regulated financial institution handling highly sensitive data didn't have sufficiently rigorous verification controls to catch it.”

A “Complete Identity Theft Kit”: What Affected Users Must Do Now

Jamie Akhtar, CEO and co-founder of CyberSmart, cautioned that, although Revolut said customer funds and its systems were unaffected, the exposed information could still be exploited for identity fraud and highly targeted phishing attacks.

Huntress’ Patel also warned that the range of data that could be compromised for affected customers “go well beyond a standard data breach notification.”

“Passports, driver's licenses, verification selfies, account statements, transaction histories, birth dates, addresses… that's not a data leak, that's a complete identity theft kit handed to whoever sent those fraudulent requests,” he said.

“Affected customers should be particularly cautious of unexpected calls, emails or messages claiming to come from Revolut, government bodies or other trusted organizations,” Akhtar advised.

“They should never disclose passwords, passcodes or one-time security codes, and should contact Revolut only through its official app or verified website.”

He also recommended users of any digital financial services, even those unaffected by this breach, to enable multi-factor authentication (MFA), use unique passwords, monitor accounts and credit reports for unusual activity and report suspected identity misuse promptly.

Image credits: Matthew Nichols1 / WD Stock Photos / Shutterstock.com