GoKawiilRevolut exposes customer passports and financial data via fake government request
Revolut disclosed that it inadvertently sent personal and financial data of some customers to a threat actor who impersonated a government agency using an authenticated domain. The leaked data reportedly includes identity documents, selfies, account statements, IBAN numbers, and transaction histories, including Bitcoin transactions. Revolut says the breach affects a limited but undisclosed number of accounts and that customer funds remain unaffected.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how attackers can exploit trust in verified domains to bypass standard data-sharing safeguards at major financial institutions. With sensitive KYC data like passports and selfies exposed, affected customers face heightened risks of identity theft and targeted fraud.
- Revolut shared customer PII and financial records with an attacker posing as a government agency.
- Exposed data includes passports, selfies, IBANs, and full transaction histories.
- The company says funds are safe, but the scope of affected customers remains undisclosed.
Source: bleepingcomputer.com, 2026-09-14
Published there as: “Revolut discloses data breach exposing financial info, passports”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.