Revolut Data Breach Exposes Customer Passports and Bitcoin Records to Attackers

Financial technology platform Revolut has suffered a notable Revolut customer data breach after internal staff members were deceived by a fraudulent government data request, resulting in the unauthorized exposure of high-net-worth client profiles.

As reported by CryptoSlate, the compromised records included highly sensitive personal identification documents and financial histories. Affected users were notified that the exposed details encompassed copies of official passports and driver's licenses, biometric verification selfies, full names, dates of birth, occupations, primary residential addresses, phone numbers, international bank account numbers, and detailed account statements. In addition, complete cryptocurrency transaction histories and digital asset withdrawal logs, including Bitcoin records, were handed over to the threat actors.

Social engineering attacks impersonating law enforcement agencies and regulatory bodies have become an increasingly common vector targeting financial institutions. Fraudsters frequently forge legal documentation and emergency disclosure requests to bypass traditional security perimeters, exploiting internal customer support protocols to obtain sensitive consumer databases.

The disclosure of comprehensive transaction logs alongside real-world identity files presents severe risks for affected cryptocurrency holders. Such details can expose high-value account holders to targeted phishing campaigns, credential stuffing attacks, and potential physical security threats if threat actors identify sizable crypto holdings tied to verified residential locations.

Revolut has reportedly initiated communication with the impacted individuals to outline protective steps and mitigation procedures. The company faces renewed scrutiny regarding its authorization workflows for external legal requests and the safeguards in place to verify the legitimacy of official inquiries before releasing private records.

Security specialists recommend that affected clients update their digital security posture, implement hardware-based authentication keys, and monitor their financial accounts closely for any suspicious activity or unauthorized contact attempts.