Revolut discloses breach involving passport and financial data

Data shared in response to an apparently official request

According to the report, the requester used a government-agency domain with valid domain-authentication credentials, leading Revolut to treat the email as authentic. Revolut said the shared data included names, birth dates, contact details, passport or driver’s-license copies, facial-verification selfies, account statements with IBAN numbers, withdrawal records, and transaction histories including Bitcoin transactions. The company said customer funds and its systems were unaffected, and did not give an exact affected-customer count.

Before this disclosure, Revolut had not publicly described the data categories involved in this incident.

Revolut has disclosed an incident in which customer data was sent to an actor that impersonated a government agency through email.

The disclosed data categories span identity verification materials and detailed financial activity. Revolut described the number of affected customers as limited, but left the number undisclosed.