Revolut, the London-based fintech whose app is used by 3.4 million people in Ireland, has acknowledged a security breach in which personal data belonging to a small group of customers was handed over to a criminal.
The attacker managed to deceive the fintech company by posing as a government official, using an e-mail address that appeared to come from a genuine government-agency domain.
The data involved was highly sensitive, including phone numbers, e-mail addresses, home addresses and dates of birth. In addition, the leaked files may have contained bank statements, transaction data, verification photos and scans of passports or driving licences.
Although the company confirmed that a “limited” number of individuals were targeted, it has refused to specify the exact number or to name the government agency that was impersonated. There are indications, suggested by security expert ZachXBT, that the scam specifically targeted high-net-worth account holders.
When the fraudulent activity was discovered, the company immediately blacklisted the fraudulent e-mail account and reported the matter to regulators and law-enforcement agencies.
Revolut assured the public that its internal systems remained secure and that no customer funds had been stolen or put at risk. The company is said to have contacted those affected directly to offer support.
This incident comes at a time of rapid global growth for the company, which serves more than 80 million users in over 30 countries. The company has recently expanded its operations to the UAE, Mexico, India and France, and has received preliminary approval to establish a national bank in the United States at the beginning of 2027.
In addition, the company is reportedly considering a stock market flotation that could value the business at up to $200 billion (€172 billion).
Business AM
Ltd
