Digital Bank Revolut Exposes Customer Data to Fake Government Agency

Global digital bank Revolut was duped by a fake information request impersonating a government agency and handed over customers’ identity data, including Bitcoin transaction records.

CoinDesk reported on September 12 that Revolut recently treated the spoofed request as legitimate and provided some customer information. The request reportedly contained credentials that were able to pass Revolut’s internal security checks.

The exposed data reportedly included passports or driver’s licenses, identity verification photos, names, dates of birth, occupations, residential addresses, email addresses and phone numbers. The fake agency also reportedly obtained International Bank Account Numbers, or IBANs, account statements, withdrawal records and complete transaction histories, including Bitcoin.

Revolut later determined the request was fake after separately contacting the government agency. The company then blocked the source of the request and notified affected customers and regulators.

No customer funds are known to have been lost.

Still, there are concerns the breach could lead to later harm. On-chain analyst ZachXBT said the impact of the incident appeared limited, but some high-net-worth individuals whose information was exposed could become targets of crime.