Revolut transmitted sensitive data to an unauthorized third party following fraudulent requests attributed to a government agency

Revolut was recently affected by a security breach in which sensitive data belonging to a limited number of customers was transmitted to an unauthorized third party. The incident occurred after the company received fraudulent requests sent from an email domain belonging to a legitimate government agency.

According to a notification sent to customers and reviewed by TechCrunch, the exposed information could have included identification and contact details, such as dates of birth, postal and email addresses, phone numbers, and copies of passports or driving licenses. In some cases, verification selfies, account statements, or transaction history may also have been transmitted.

Revolut immediately blocked the address used and alerted the relevant government agency, law enforcement authorities, data protection authorities, and financial regulatory bodies. The company maintains that its systems and customers' funds were not affected.

Researcher ZachXBT claims that those affected primarily included users with significant wealth.

The incident comes as Revolut considers a potential stock market listing and pursues a valuation of up to $200 billion.