Revolut discloses customer data to third party via fraudulent government email requests

Revolut confirmed that it disclosed customer data to an unauthorized third party after receiving fraudulent requests from a legitimate government agency email domain. The exposed data included identity documents, contact details, and transaction histories, though the company described the number of affected customers as 'limited'. This suggests the breach was not a mass compromise but may have been targeted at specific individuals, potentially high-net-worth users, as indicated by security researcher ZachXBT.

The incident reveals a critical weakness in email-based verification processes for sensitive data requests. Even when requests originate from a legitimate government domain, fintech platforms must implement additional layers of authentication to prevent fraudulent disclosures. Revolut’s response, blocking the email address and notifying regulators, addresses the immediate fallout but does not resolve the underlying vulnerability in request validation.

For engineers, this breach underscores the need to harden systems against impersonation attacks. While Revolut stated that its systems and customer funds were unaffected, the exposure of sensitive data could have long-term consequences, including identity theft and phishing risks. The lack of transparency about the government agency involved or the number of affected customers may also erode trust in the platform’s security practices.

The timing of this breach is notable, as Revolut is expanding its global banking footprint and pursuing a potential public listing. Regulatory scrutiny of its security measures is likely to intensify, particularly as it seeks approvals in new markets like the U.S. Engineers working on similar platforms must prioritize request validation and fraud detection to avoid comparable incidents.