Fintech leader Revolut revealed a customer data breach caused by a fraudulent scheme where attackers exploited a legitimate government agency’s email domain to submit fake information requests. The breach exposed sensitive information including customer identities, birth dates, contact details, and copies of official documents like passports and driver’s licenses. Revolut’s notification to affected users indicated the leak may also have involved verification selfies, transaction histories, and account statements. While the firm confirmed only a “limited” number of customers were affected, it did not specify exact figures or reveal which government agency’s domain was compromised.

The company responded swiftly by blocking the fraudulent email address once it detected the impersonation scam and informed the relevant authorities, including law enforcement and financial regulators. Although Revolut assured that its core systems and customer funds were secure, the breach posed significant risks due to the nature of the exposed personal data. Security experts noted that the attack appeared targeted primarily at high-net-worth clients, aligning with the firm's growing affluent customer base. Revolut is actively communicating with impacted clients to manage the fallout.

This incident comes at a critical time as Revolut plans a major global expansion and a potential IPO that could value the company at up to $200 billion. The London-based fintech currently serves over 80 million users worldwide and holds banking licenses across more than 30 countries. Its recent moves include expansion into markets like India, Mexico, France, and the UAE, alongside regulatory approvals such as a conditional U.S. national bank charter expected to launch in early 2027. These developments underscore Revolut’s ambition to become a dominant global banking platform.

Despite the setback, Revolut appears focused on bolstering its security posture as it scales and navigates the complex regulatory landscape of international finance. The breach highlights the sophisticated tactics bad actors use, exploiting trusted channels to bypass defenses. As Revolut progresses toward an IPO and broadens its footprint, maintaining customer trust through enhanced cybersecurity will be crucial to its long-term success and reputation in the highly competitive fintech sector.