British fintech Revolut has confirmed it disclosed sensitive customer records, including passport copies, verification selfies and full transaction histories, to an unauthorized third party who submitted fraudulent information requests from a legitimate government agency's email domain. A Revolut spokesperson told TechCrunch and BNO News that a "limited number" of customers were affected by what it called a "sophisticated external impersonation scam," but the company has not published a figure, has not named the agency involved, and has not said whether the incident was confined to a single market. Affected customers began receiving notification emails on Friday, September 11, 2026. No source in this set provides a record count, and no two sources offer competing numbers to reconcile: the size of the exposure remains undisclosed by the only party who knows it.
What Happened
The account that emerges consistently across all eight sources is that this was not a network intrusion. Revolut received an information request that appeared to come from a government authority. Per the customer notice quoted at length by The Crypto Times and CryptoSlate, the request "originated from an unauthorized email account created directly within an official government authority's domain infrastructure" and "carried genuine domain authentication credentials," which led Revolut to fulfil it under what it described as a reasonable belief that the request was lawful.
Revolut's compliance function compiled and transmitted the requested files. Only afterward, after contacting the impersonated agency through a separate channel, did the company establish that no official had sent the request. Revolut then blocked the address and, in its own words to BNO News, "alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators." The spokesperson stated that "Revolut systems and customer funds are unaffected."
The story reached the public through customers rather than the company. The Crypto Times and ChainAffairs both report that former Mt. Gox CEO Mark Karpelès posted substantial excerpts of the notice on September 12 at 07:06 UTC, after on-chain investigator ZachXBT flagged the case on Telegram. As of 09:13 UTC on September 12, The Crypto Times reported that Revolut had issued no numbered press statement and nothing from its main @Revolut account; the @revolutsupport account had replied to one user at 06:42 UTC with a generic line about taking data protection seriously. ChainAffairs adds that ZachXBT later said Revolut's official accounts blocked him on X, a claim carried by a single OTHER-tier source and not independently corroborated here.
What Was Taken
The exposed categories are consistent across the customer notice as quoted by multiple outlets, and fall into four groups.
Identity and contact data: full names, dates of birth, occupations, postal addresses, email addresses and phone numbers.
Verification records: copies of government identity documents including passports and driver's licenses, plus the selfie images customers submit during onboarding. ChainAffairs reports that the notice specifies the biometric templates derived from those selfies were not included; that caveat appears in only one source.
Financial records: account statements with IBANs, account status, account opening dates and wallet reference numbers, withdrawal records, and complete transaction histories. Multiple sources, including CryptoSlate, The Crypto Times, CryptoCompass and BNO News, state explicitly that Bitcoin transaction activity was part of what was disclosed.
Not included, per CryptoCompass and ChainAffairs: passwords, card PINs, private keys and customer funds. No theft of funds has been reported.
On targeting, accounts differ in confidence rather than substance. Revolut says only that the group was "limited"; a person familiar with the matter told BNO News it was a "very limited group." CryptoCompass asserts the leak targeted a hand-picked set of high-net-worth Bitcoin holders. ZachXBT, as relayed by ChainAffairs, described it more cautiously as likely limited in scope and possibly aimed at high-net-worth accounts. The high-net-worth framing should be read as informed inference from OTHER-tier reporting, not as a confirmed finding.
Why It Matters
The consequential detail is that the disclosed data joins verified real-world identity to on-chain activity. A passport scan, a home address and a complete Bitcoin transaction history in the same package is a targeting dossier. It supports physical coercion, extortion and the so-called wrench attack in a way that neither the KYC file nor the chain analysis would on its own. The absence of stolen funds is not the measure of harm here, and the data cannot be reissued: a customer can rotate a password, not a date of birth or a passport image already in an adversary's hands.
The second-order point is institutional. Every regulated financial institution is legally obliged to respond to law enforcement and government data requests, frequently under time pressure and confidentiality constraints that discourage the recipient from calling around to verify. That obligation creates a trusted channel that sits outside most security tooling, staffed by legal and compliance rather than security engineering. Revolut has more than 80 million customers and operates as a bank in over 30 countries; the U.S. Office of the Comptroller of the Currency granted it conditional approval for a national bank charter earlier this month, with a launch expected in the first half of 2027. A firm of that scale being walked through the legal-process door tells every peer institution the same door is open.
Several sources also note the customer-relations dimension. Marc Zeller, founder of the Aave Chan Initiative and an affected user, posted that the disclosure came shortly after Revolut demanded extensive additional documentation from him under threat of account closure within 20 days. That juxtaposition, compelled data collection followed by uncontrolled data release, is the argument that data minimisation is a security control and not merely a privacy preference.
The Attack Technique
This is a fraudulent emergency data request, and it is a known and recurring vector: Pasquale Pillitteri's writeup situates it alongside earlier incidents in which Meta and Apple were induced to hand over user data on forged or hijacked law enforcement requests.
The mechanical detail that makes this case instructive is that the attacker did not spoof the government domain. They operated an unauthorized mailbox inside it. CryptoSlate and The Crypto Times both describe the sending account as created within the genuine agency's domain infrastructure and carrying valid authentication credentials. CryptoCompass states that Revolut's automated anti-spoofing filters therefore read the message as authentic and passed it through.
That distinction is the entire lesson. SPF, DKIM and DMARC answer the question "was this message sent by a server authorized for this domain." They say nothing about whether the human behind the mailbox holds any authority to demand data. When an attacker holds a real mailbox on a real government domain, every email authentication check returns a pass, correctly, and the control provides exactly zero signal about the legitimacy of the request. CryptoCompass reports that staff on the legal compliance team compiled and transmitted the files without independently confirming the requester's authority through an out-of-band channel. How the attacker obtained the mailbox in the first place, whether through compromise of an agency account or creation of one inside agency infrastructure, is not established by any source here, and Revolut has not addressed it.
Revolut has also not explained, as CryptoSlate notes, why records were released before the request was confirmed outside email. That gap is the open question in the public record.
What Organizations Should Do
Treat email authentication as identifying the domain, not the requester. A DMARC pass on a .gov message is evidence the mail came from that domain's infrastructure and nothing more. Remove any policy language that treats authentication results as sufficient grounds to release data.
Mandate out-of-band callback before any disclosure, with no exceptions for urgency. Verify every legal or emergency data request by contacting the agency through a number or portal obtained independently, never from the request itself. Revolut performed this step, but performed it after transmitting the files. Sequence is the control.
Build a hold-and-verify default for emergency requests. Genuine emergency disclosure requests are rare and the claimed urgency is the primary lever attackers pull. Establish an internal SLA that permits a verification hold and give compliance staff explicit authorization to use it without escalation anxiety.
Require dual authorization for high-sensitivity disclosures. Any release including identity documents, biometric verification images, or complete transaction histories should need a second reviewer and a documented verification record. Route these through named official request portals rather than email wherever the agency operates one.
Minimise and segment what a single request can reach. The blast radius was defined by how much was retrievable in one compilation step. Apply retention limits to onboarding artefacts such as verification selfies, and enforce technical limits on the volume and breadth of records any one disclosure workflow can pull.
Red team the legal process channel. Compliance and legal teams are rarely included in phishing simulations or tabletop exercises. Run an authorized simulated emergency data request against your own intake process and measure whether the callback happens before the data moves.
Notify affected individuals with threat context, not just data categories. Where identity documents and financial histories were disclosed together, customers face targeted extortion and physical risk. Pair notification with document replacement guidance, heightened account monitoring and explicit warning about follow-on social engineering that will cite the leaked details to establish credibility.
Sources: Revolut confirms customer data breach through fake government reque... | Revolut tricked into handing hackers the passports and Bitcoin ... | Revolut Handed Over Bitcoin Histories, Passports on Spoofed Governm... | Revolut Confirms Data Breach Caused by Fraudulent Government Reques... | Revolut shared sensitive customer data after fake government request | Revolut Data Breach Links Bitcoin Wallets to Real Identities Crypt... | Revolut Confirms Data Breach After Fake Government Request Tricks V... | Revolut Handed Over Passports and Bitcoin Records to a Fake Governm...