Revolut Exposes Sensitive Customer Info in Fake Agency Request Scandal
A major incident has occurred at Revolut, a fintech company that serves over 80 million customers globally. According to a customer notice shared on Telegram by on-chain investigator ZachXBT, an unauthorized sender used an official government agency's email domain to request sensitive customer information from Revolut.
The request was made directly from an unauthorized account using the agency's official email domain, and it carried valid domain authentication credentials. This led Revolut to believe that the request was genuine when it provided the information.
The disclosed records included identity documents, verification selfies, full transaction histories, including Bitcoin transactions, and wallet reference numbers. The incident appears to have targeted high-net-worth users, according to ZachXBT.