[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foN09ov1RFMB2IfmXLF_fNTZHrMs3bGRl1vTV5Yg9eE0":3},{"article":4,"iocs":39},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":26},"c7a5d6bf-86e6-479c-892c-751c5f1d6f5f","Personal, Financial Info Exposed in Revolut Data Breach","personal-financial-info-exposed-in-revolut-data-breach-710682","The company unintentionally disclosed users’ information to a third party impersonating a government agency. The post Personal, Financial Info Exposed in Revolut Data Breach appeared first on SecurityWeek.","Fintech company Revolut has reported a data breach where a third party, impersonating a government agency, gained access to user data. The exposed information includes PII such as names, addresses, and identification documents, as well as financial details like IBANs and transaction histories. Revolut claims systems and customer funds remain unaffected and has notified affected users and relevant authorities.","Revolut data breach exposes personal and financial info via impersonation scam.","British fintech giant Revolut is notifying a subset of users that their personal and financial information was compromised in a data breach. Based in London, the neobank and financial technology company provides banking and investment services to over 80 million users in 160 countries and regions. Late last week, the company informed a small number of users that their personally identifiable information (PII) was exposed to a third party posing as a government agency. The exposed data, it said in emails to the affected users, included names, addresses, phone numbers, email addresses, dates of birth, occupation, copies of driver’s licenses and passports, and verification selfies. Financial information, including IBANs, account statements, withdrawal records, and full transaction history, including Bitcoin, was also exposed. The request carried valid technical domain credentials and was treated as an authentic agency inquiry. All financial institutions must comply with legal requests from law enforcement and government agencies.Advertisement. Scroll to continue reading. Responding to a SecurityWeek inquiry, a Revolut spokesperson confirmed the incident. “Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information. After discovering the data breach, the company immediately blocked the attackers’ email address and notified the “relevant government agency as well as enforcement agencies, data protection, and financial regulators,” the spokesperson added. According to Revolut, only a subset of its users was affected. However, the company did not say how many individuals were impacted. “Revolut systems and customer funds are unaffected. We have contacted the limited number of impacted individuals directly to inform them and provide support,” Revolut’s representative said. Related: Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution Related: Telus Warns Customers of Account Breaches Related: Phishing Research Challenges Conventional Security Awareness Testing Related: Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-DaysGitLab Vulnerability Exploited One Day After DisclosureCheck Point Patches Critical VPN VulnerabilitiesSurfshark Systems Targeted by HackersPaperCut Flaws Exploited in AI-Powered AttacksCritical NetScaler Vulnerability Exploited in Attacks4.1 Million Impacted by AdaptHealth Data BreachNew ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender Latest News New Warnings About the Risks of AI to Humanity Revive a Long-Running DebateThe Race to Control AI and Protect What Makes Us HumanChinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code ExecutionCISOs Race to Control AI Agents Without Destroying Their ValueTelus Warns Customers of Account BreachesThree JFrog Artifactory Flaws Exploited for Backdoor DeploymentConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksAnthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch Up Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveZero Networks has named Yossi Dagan as Chief Financial Officer.Manifold has appointed Joe Sullivan to its Board of Directors.Patrick McKinney has joined Turing as Chief Information Security Officer.More People On The MoveExpert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, \"data\" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fpersonal-financial-info-exposed-in-revolut-data-breach\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FRevolut.jpeg","2026-09-14T13:03:35+00:00","2026-09-14T14:00:09.755568+00:00",7,[18],{"name":19,"type":20},"Revolut","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":21,"icon":23,"name":24,"slug":25},null,"Breaches","breaches",[27,29,34],{"category":28},{"id":21,"icon":23,"name":24,"slug":25},{"category":30},{"id":31,"icon":23,"name":32,"slug":33},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":35},{"id":36,"icon":23,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[]]