Revolut disclosed sensitive customer information after an unauthorized party submitted fraudulent data requests through an email account associated with a legitimate government-agency domain.
The exposed records may have included names, home addresses, dates of birth, occupations, telephone numbers, email addresses, passports, driving licenses and identity-verification selfies, according to customer notices reviewed by CoinDesk.
Financial information was also potentially disclosed. The records reportedly included IBANs, account statements, withdrawal details and complete transaction histories, including customers’ Bitcoin activity.
Revolut said its internal systems were not breached and customer funds remained safe. The failure occurred in authorization: a fraudulent external request passed the checks used to determine whether information could lawfully be disclosed.
The company described the incident as a sophisticated impersonation scam and said only a limited number of customers were affected. It has not disclosed the exact number, the government agency involved or whether the exposure was confined to one jurisdiction, according to The Block’s independent follow-up.
Revolut said it blocked the requesting address, contacted affected users and alerted the relevant agency, law-enforcement bodies, financial regulators and data-protection authorities.
The combination of identity records and blockchain activity creates an especially serious threat. Public Bitcoin transactions are pseudonymous; combining them with passports, addresses and names can identify the people controlling particular financial activity and potentially expose high-value targets.
TOKEN RECON ASSESSMENT
This was not a conventional systems intrusion. It was a failure to authenticate a supposedly lawful request.
That makes the incident relevant to every exchange, custodian and financial institution holding detailed know-your-customer records.
The immediate risks include targeted phishing, physical coercion, identity theft and attempts to connect additional wallets with exposed customers.
Token Recon is watching the number of affected users, regulatory findings, evidence of downstream targeting and whether Revolut introduces independent confirmation before responding to sensitive government-data demands.
Sources
CoinDesk. Revolut exposes identity records and Bitcoin histories after fake request
