Revolut Data Breach Exposes Customer KYC and Bitcoin Records via Fake Government Request

Financial technology platform Revolut has disclosed a security incident involving unauthorized access to user records. The breach occurred after attackers successfully targeted the company using a fraudulent request originating from a spoofed government domain, leading to the release of sensitive user information.

Attack Method and Compromised Data

According to reports from The Block and Cointelegraph, the incident stemmed from a targeted phishing scheme in which malicious actors impersonated official authorities through a counterfeit government email. The fraudulent inquiry deceived internal verification measures, granting the perpetrators access to private customer accounts.

Data compromised in the breach spans both standard personal identifiers and cryptocurrency activity. Disclosed information includes know-your-customer (KYC) documentation, identification paperwork, and comprehensive financial transaction histories. Furthermore, records specifically detailing customer Bitcoin transaction histories were compromised during the incident, as highlighted by AMBCrypto.

Security Concerns and Industry Scrutiny

The exposure of detailed identification materials alongside cryptocurrency transaction logs has raised operational and privacy concerns. As noted by The Block, the availability of combined identity and digital asset records creates heightened security risks, particularly for high-net-worth individuals using the platform.

Industry observers point out that the incident underscores systemic challenges associated with authenticating external regulatory and law enforcement inquiries. The compromise of sensitive files via a spoofed communication channel calls into question the strength of internal compliance verification procedures.

Potential Regulatory and Custodial Repercussions

Revolut's breach introduces broader questions regarding data handling and asset custody. Cointelegraph notes that the incident introduces notable reputational vulnerabilities for the fintech firm and could invite additional oversight from data protection and financial regulators.

Additionally, the incident may negatively affect user confidence in Revolut's cryptocurrency and asset custody offerings. As financial platforms continue integrating traditional banking features with digital asset services, safeguarding sensitive transaction records against social engineering and domain spoofing remains a critical vulnerability across the industry.