Revolut Breach Exposes Passports, IBANs, Bitcoin Data; 80M Users at Risk

A threat actor didn't breach Revolut's core banking systems—it exploited the trust mechanism that financial institutions must maintain for government legal requests. The 80 million-user neobank handed over passports, selfies, IBANs, and full Bitcoin transaction histories because an inbound email carried valid domain credentials. For cybersecurity teams, this is a warning that domain authentication alone cannot secure high-sensitivity PII flows.

On September 11, 2026, British fintech giant Revolut began notifying a subset of its more than 80 million customers across 160 countries that a third party posing as a government agency had obtained extensive personal and financial information through email requests that carried valid technical domain credentials. The London-based neobank, which also serves 800,000 business customers, confirmed the incident to SecurityWeek and BleepingComputer, stating that the exposed records included full names, postal addresses, phone numbers, email addresses, dates of birth, occupation, copies of driver's licenses and passports, facial verification selfies used for Know Your Customer checks, IBANs, account statements, withdrawal records, and complete transaction histories, including Bitcoin activity. Revolut emphasized that its systems and customer funds were unaffected and that only a limited number of individuals were impacted, but it declined to disclose an exact figure.

“

A threat actor didn't breach Revolut's core banking systems—it exploited the trust mechanism that financial institutions must maintain for government legal requests.

The attack illustrates a dangerous evolution in business email compromise and social engineering. Rather than breaching Revolut's internal systems or exploiting a software vulnerability, the threat actor leveraged a legitimate government agency domain email with valid authentication credentials to submit fraudulent requests for information. Financial institutions are legally required to comply with lawful requests from government and law enforcement agencies, so the email's domain authentication provided enough confidence for Revolut to fulfill it. A Revolut spokesperson characterized the event as a 'sophisticated external impersonation scam' and said the company immediately blocked the attacker's email address upon detection, then alerted the relevant government agency, enforcement agencies, data protection authorities, and financial regulators.

For affected users and the broader fintech sector, the exposure is unusually severe. The combination of government-grade identity documents, facial selfies, and comprehensive financial histories, including Bitcoin transactions, creates a rich data set for identity theft, account takeover, targeted phishing, extortion, and even cryptocurrency-related fraud. Unlike a payment card number that can be replaced, passports, driver's licenses, and biometric selfies cannot be easily reissued. Full transaction histories can reveal spending patterns, employer details, and crypto holdings, enabling highly convincing impersonation. The fact that Revolut has not revealed how many customers were affected compounds uncertainty; the absence of a disclosed figure makes it difficult for regulators, banks, and individuals to assess scope and respond appropriately.