Revolut Reports Exposure of Customer Records Following Fraudulent Government Domain Request

Revolut announced on September 13 that sensitive data belonging to a limited group of customers was disclosed following fraudulent information requests sent from an email account hosted on a legitimate government agency domain. The company reported the incident to affected users, regulators, and law enforcement.

The request appeared authentic due to genuine domain-authentication credentials on the agency's infrastructure. Revolut stated that it blocked the address upon discovery and emphasized that its core internal systems and customer funds remained unaffected, characterizing the breach as a fraudulent disclosure request rather than a direct infrastructure intrusion.

According to a customer notification shared by Mark Karpelès on X, the potentially exposed records included identity documents, verification photos, addresses, IBANs, account statements, and complete transaction histories, including Bitcoin transfers. As of September 12, Revolut had not publicly disclosed the specific government agency involved or the exact number of impacted accounts.