Revolut has confirmed that it released sensitive customer data, including copies of identity documents, to an unauthorized third party that submitted information requests from a legitimate government agency email domain. The company confirmed the incident on September 12, 2026, after affected customers received notification emails. Revolut describes the number of affected customers as limited and has not published a figure.
According to a Revolut spokesperson, the company identified an external impersonation scam in which a third party used a genuine government agency domain email to submit fraudulent requests for information. In its notice to customers, reported by BleepingComputer, Revolut said the requests carried valid domain authentication credentials and were fulfilled in the belief that they came from an authentic agency.
Revolut says that on detection it blocked the sending address and alerted the agency concerned, law enforcement, data protection authorities and financial regulators. The company told TechCrunch that its systems and customer funds were unaffected. Revolut has not said when the requests were received or when it detected the scheme. The incident date used for this report is the public confirmation date, not the start of the activity.
Revolut told Cointelegraph it reported the matter to Italian authorities. Italian news agency ANSA has reported that Italy's cybercrime police are investigating the compromise of a government email account linked to the requests. Revolut has declined to name the agency, citing the police investigation. An individual has claimed responsibility and described a wider, longer operation; this has not been confirmed.
The customer notice lists identity details (full name, date of birth, occupation), contact details (postal address, email address, phone number) and copies of identity documents such as passports and driver's licenses. The notice also references facial verification selfies collected during account opening, account statements including IBANs, withdrawal records and transaction histories, including Bitcoin transactions. TechCrunch's reading of the notice describes selfies, statements and transaction histories as data that may have been included.
Revolut has not disclosed how many customers were affected or in which countries. Unverified figures circulating online have not been confirmed by the company or any regulator.
No system was breached and no credential was stolen from Revolut. The failure point was the lawful request workflow: a team handled an email as authoritative because the sending domain authenticated correctly. Domain authentication proves a message came from a domain, not that the person behind the mailbox is entitled to the data. The FBI warned in November 2024 that compromised US and foreign government email accounts were being used to send fraudulent emergency data requests, so this is a known pattern, now producing a full KYC file.
For banks, payment firms and any regulated business that answers law enforcement or regulator requests, the question to ask this week is simple: who can release a complete customer file on the strength of an email, and what independent check happens first? Controls worth testing include callback verification through contact details sourced separately from the request, a second approver for identity documents and financial histories, and disclosing only the minimum data a request actually requires. This sits squarely in identity, access and fraud governance, where continuous monitoring of unusual request volumes can catch a pattern before it becomes a notification.
The number and location of affected customers, when the requests were received and fulfilled, which agency's account was used, whether other financial institutions received similar requests, and whether any regulator will open a formal inquiry.
1. Revolut confirms customer data breach through fake government requests, TechCrunch, September 12, 2026. Revolut spokesperson confirmation, limited population, data types in customer notice, systems and funds unaffected.
2. Revolut discloses data breach exposing financial info, passports, BleepingComputer, September 14, 2026. Customer notice wording on valid domain authentication, full list of data types, notification of regulators.
3. Personal, financial info exposed in Revolut data breach, SecurityWeek, September 14, 2026. Corroborates Revolut statement and data types; population undisclosed.
4. Italy investigates government email breach linked to Revolut data leak, Cointelegraph via TradingView, September 16, 2026. Revolut reported to Italian authorities; ANSA report of Italian cybercrime police investigation; Revolut declined to name the agency.
5. Easy access to information for conducting fraudulent emergency data requests impacts US-based companies and law enforcement agencies, FBI Private Industry Notification 20241104-001, November 4, 2024. Compromised government email accounts used for fraudulent data requests.
