Revolut Exposes Customer Data in Phishing Attack

Revolut, a British fintech company, has reported a significant data breach resulting from a sophisticated phishing attack that successfully impersonated a government official. The attacker sent a fraudulent email that passed all standard email authentication protocols, including SPF, DKIM, and DMARC, leading Revolut to mistakenly provide sensitive customer information. This included identity documents, verification selfies, full names, dates of birth, contact details, and financial records such as transaction histories and Bitcoin activity records.

The incident, characterized by Revolut as an external impersonation scam, has raised concerns due to the nature of the exposed data, particularly the Bitcoin transaction histories. This information could potentially facilitate identity fraud and targeted phishing campaigns against cryptocurrency holders. Although Revolut described the number of affected customers as limited, the breach has attracted attention as notable figures in the crypto space began sharing their experiences following the notifications they received on September 11, 2026.

Revolut has taken steps to mitigate the situation by blocking the unauthorized email address involved in the attack and notifying law enforcement and relevant regulatory agencies. The company emphasized that its internal systems were not compromised, and no customer funds were moved during the incident. However, the timing of the breach is particularly challenging for Revolut, as it is currently seeking a banking license and exploring a public listing with a valuation target of approximately $200 billion.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News