Reported by 10 outlets

Timeline

1. original reporting

   Revolut discloses data breach exposing financial info, passports

   bleepingcomputer.com · 29d ago · September 14th, 2026

   Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. Revolut operates in over 160 countries and regions and offers banking, money management, and investment services to more than 80 million customers worldwide, including 800,000 business customers. In emails sent to affected customers, the company said that the attacker requested the personally identifiable information (PII) via email using a government agency's domain. "Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency's email domain," it told affected customers. "As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request." Revolut says that the data sent to the threat actors includes affected individuals' identity details (i.e., full name, date of birth, occupation), contact details (postal address, email address, and telephone number), as well as document and verification data such as copies of your identity documents (passport and/or driver's license) and facial verification images (selfies provided for Know Your Client verification when opening an account). The exposed information also includes account statements (including IBAN numbers), withd

2. update from securityonline.info

   The Revolut data breach leaked passports, selfies, and crypto records of wealthy users, raising the risk of real-world wrench attacks. Detai

   securityonline.info · 29d ago · September 14th, 2026

   The Revolut data breach leaked passports, selfies, and crypto records of wealthy users, raising the risk of real-world wrench attacks. Detai

   via Mastodon https://securityonline.info/revolut-breach-wrench-attack-risk/?utm_source=mastodon&utm_medium=jetpack_social

3. update from www.frandroid.com

   Revolut breach: passports and customer data distributed on Telegram

   www.frandroid.com · 29d ago · September 14th, 2026

   The broadcast channel changes the game -- Telegram makes this type of data widely accessible. via Mastodon https://www.frandroid.com/services/banque-en-ligne/3246217_fuite-revolut-des-passeports-et-donnees-clients-sont-diffuses-diffuses-sur-telegram

4. mentioned by www.bleepingcomputer.com

   Revolut discloses data breach exposing financial info, passports

   www.bleepingcomputer.com · 29d ago · September 14th, 2026

5. update from www.martincid.com

   Revolut gave scammers your passport — no hack needed, just a fake government email https://www. martincid.com/technology-sv/re volut-data-br

   www.martincid.com · 29d ago · September 14th, 2026

   Revolut gave scammers your passport — no hack needed, just a fake government email https://www.

6. update from desnips.nl

   Revolut leaks passports and bitcoin data from wealthy customers through fake government email

   desnips.nl · 29d ago · September 14th, 2026

   Revolut leaks passports and bitcoin data from wealthy customers through fake government email

   The digital bank fell for an email from a hacked government domain. Although no money was stolen, passports and crypto transaction history of wealthy customers are now exposed. The attacker used a compromised government email domain to trick Revolut into sharing customer data. While no financial losses were reported, the exposed data includes passport scans, selfies, and cryptocurrency transaction records belonging to high-net-worth customers. The breach was confirmed by Revolut on September 12, 2026. The company stated it notified affected customers and alerted the relevant government agency. The incident involved social engineering through fake government requests, not a technical vulnerability in Revolut's systems. via Mastodon https://desnips.nl/f62b9e3-Revolut-datalek-cybersecurity-banken/

7. mentioned by www.bleepingcomputer.com

   🤖 Revolut discloses a data breach after sharing customer data with a threat actor impersonating a government agency. Exposed: financial info

   www.bleepingcomputer.com · 29d ago · September 14th, 2026

8. update from malware.news

   Revolut gave customer IDs and financial data to a government impostor

   malware.news · 29d ago · September 14th, 2026

   Revolut has acknowledged that it disclosed sensitive customer records to an unauthorized party. Revolut is a London-based banking and financial platform with more than 80 million customers globally, according to the company . Revolut describes this as an external impersonation scam, not an intrusion into its systems. The attacker appears to have abused the trust attached to a real government email domain to make bogus requests for customer information. Revolut detected the activity, blocked the sending address, and says it notified the relevant agency, law enforcement, data protection authorities, and financial regulators. “Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators.” Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of i

9. update from improvsafe.gumroad.com

   # revolut # hack # cybersecurity - The consequences of this type of hack are terrifying

   improvsafe.gumroad.com · 29d ago · September 14th, 2026

   revolut # hack # cybersecurity https:// x.com/KuptoKosmos/status/20992 49970582831328?s=20 Les conséquences de ce genre de hack sont effro

   via Mastodon https://improvsafe.gumroad.com/l/imjkkn

10. update from www.theregister.com

    Revolut falls for fake government requests, hands over customer data Passports, selfies, transaction histories exposed as self-proclaimed cu

    www.theregister.com · 29d ago · September 14th, 2026

    Revolut falls for fake government requests, hands over customer data Passports, selfies, transaction histories exposed as self-proclaimed cu

    via Mastodon https://www.theregister.com/cyber-crime/2026/09/14/revolut-falls-for-fake-government-requests-hands-over-customer-data/5296118

11. update from www.internationalcyberdigest.com

    International Cyber Digest an independent cybersecurity news Revolut gave away customers' data https://www. internationalcyberdigest.com/r e

    www.internationalcyberdigest.com · 29d ago · September 14th, 2026

    International Cyber Digest an independent cybersecurity news Revolut gave away customers' data https://www.

12. update from securityweek.com

    Personal, Financial Info Exposed in Revolut Data Breach

    securityweek.com · 29d ago · September 14th, 2026

    British fintech giant Revolut is notifying a subset of users that their personal and financial information was compromised in a data breach. Late last week, the company informed a small number of users that their personally identifiable information (PII) was exposed to a third party posing as a government agency. All financial institutions must comply with legal requests from law enforcement and government agencies. Responding to a SecurityWeek inquiry, a Revolut spokesperson confirmed the incident. “Revolut recently identified a sophisticated external impersonation scam where an unauthorized third party utilized a legitimate government agency domain email to submit fraudulent requests for information.