Revolut confirms customer data breach through fake government requests

Revolut disclosed that a fraudster used a legitimate government-agency email domain to request and obtain customers’ personal data, including birth dates, addresses, phone numbers, passport and driver’s-license copies, verification selfies, statements, and transaction histories. The breach affected a limited, undisclosed number of users, prompting Revolut to block the malicious address, notify the agency, law enforcement and regulators, and confirm that its systems and customer funds remain unaffected.