# Revolut Data Breach Exposes Customer Information to Hackers Neobank leaks sensitive user data after falling for government impersonation scam - **Source:** [Bitcoin News](https://brifing.si/source/d8aeaf1e-9839-4dad-9d25-7a6bf3fbeef8) - **Published:** 2026-09-12 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/e0464869-7cda-43c4-80a7-0001a69379b5 ## The Breach Incident Revolut, a UK-based neobank with 70 million users globally, accidentally shared sensitive customer data with hackers posing as a government agency. The breach occurred when the company complied with an information request from an unauthorized email address that appeared legitimate due to proper domain authentication. The leaked data includes names, birth dates, addresses, and contact information, putting affected users at significant risk of identity theft and personal security threats. ## Scope of Leaked Data The compromised information goes beyond basic personal details to include highly sensitive verification documents. Revolut confirmed sharing passport and driver's license images along with facial verification pictures, creating substantial risks for identity fraud. While the exact number of affected users remains unknown, blockchain investigator ZachXBT noted the attack appeared targeted at high-net-worth individuals, increasing their vulnerability to financial crimes and physical attacks. ## How the Hack Succeeded The hackers executed a sophisticated phishing scheme by creating an email that mimicked a legitimate government request, complete with authentic-looking domain credentials. Revolut's compliance team processed the request without recognizing the deception. This incident highlights vulnerabilities in standard Know Your Customer (KYC) verification processes, which financial institutions rely on for regulatory compliance but which can be exploited by bad actors. ## Victim Testimony Marc Zeller, founder of the Aave Chan Initiative and one of the affected customers, publicly shared his experience after discovering his personal data had been compromised. His social media post criticizing KYC practices as ineffective and dangerous sparked wider discussion about the balance between financial regulation and user security. Zeller's case demonstrates how even experienced crypto professionals can become victims of institutional data breaches. ## Industry Context This breach occurs amid growing global criticism of mandatory KYC requirements in fintech and crypto sectors. Several recent incidents have seen financial institutions and crypto companies leak client information to threat actors. The frequency and severity of so-called 'wrench attacks' - physical threats to obtain crypto assets - have increased in parallel, creating a dangerous environment for users whose personal data becomes exposed. ## Revolut's Response While Revolut promptly notified affected customers via email, the company has not disclosed which government agency was impersonated or provided detailed remediation plans. Their statement emphasized that the request appeared authentic at the time of processing. This limited transparency has drawn criticism from cybersecurity experts who argue financial institutions need stronger verification protocols for sensitive data requests. ## Security Implications The breach exposes fundamental weaknesses in how fintech companies handle sensitive customer data. Cybersecurity analysts note that even with proper domain authentication, additional verification steps should be mandatory for sharing personal information. The incident serves as a warning about over-reliance on email communications for critical data transfers, especially in an era of increasingly sophisticated phishing techniques. ## Broader Impact This incident amplifies ongoing debates about privacy versus regulation in digital finance. As more financial services move online, the Revolut breach demonstrates how security gaps can have real-world consequences beyond digital fraud. The targeting of high-value accounts suggests criminals are becoming more strategic in their attacks, requiring financial institutions to develop equally sophisticated defense mechanisms. ## Sources covering this story - https://news.bitcoin.com/security/revolut-leaks-customer-data-to-hackers-posing-as-state-agency/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._