Revolut Discloses Data Breach Affecting 680 Customers After Phishing Attack

Financial technology firm Revolut has contacted 680 customers to inform them of a data breach after the company was deceived into handing over sensitive personal information to a cybercriminal, according to a report from the Financial Times.

Details of the Breach

The incident occurred when a hacker, using a legitimate government email address, sent a fraudulent request for private customer information. Revolut complied with the request, inadvertently exposing a range of highly sensitive data.

According to the report, the compromised information includes:

• Passport details and identity cards
• Bank account numbers
• Home addresses
• Customer verification photos
• Records of Bitcoin activity

Hackers claiming responsibility are now reportedly threatening to release the information publicly if a ransom is not paid.

Regulatory Scrutiny and Company Response

Ad

Revolut has reported the incident to Britain's Information Commissioner's Office (ICO), the country's data protection watchdog. The ICO confirmed on Monday that it is investigating the matter.

In a statement, Revolut said it "immediately blocked the address" upon discovering the fraudulent nature of the request. The company also noted it had notified regulators and spent the weekend contacting all affected customers.

Context and Implications

Among those affected was Mark Karpelès, the former chief executive of the collapsed bitcoin exchange Mt Gox. Karpelès, who was notified by Revolut via email, stated his belief that the company should not have shared the information, regardless of whether the request appeared to originate from a verified government address.

This breach exposes Revolut to potential regulatory fines and reputational damage. For the affected customers, the exposure of such detailed personal and financial information creates a significant risk of identity theft and targeted fraud.