Revolut Handed Sensitive Customer Data to Scammers After Fake Government Request
Revolut has confirmed a pretty wild data breach involving attackers who apparently didn’t need to hack Revolut’s systems at all.
According to Reuters, Revolut received fraudulent requests for customer information that appeared to come from a legitimate government agency email domain. Revolut believed the requests were genuine and disclosed sensitive customer information to an unauthorized third party.
Other reports say the information exposed to the attackers included data such as:
The fraudulent request reportedly came through an actual government agency domain, making it much more convincing than a basic spoofed email.
Revolut later discovered that the request was unauthorized after contacting the government agency.
Revolut says affected customers have been notified, and the company has also contacted law enforcement, regulators and the government agency involved.
What’s interesting about this one is that there apparently wasn’t some complicated exploit or zero-day involved. The attackers essentially targeted the process Revolut uses to respond to government information requests and managed to convince the company to hand the information over voluntarily.
Makes you wonder how many companies actually independently verify government data requests before releasing customer information.
What do you guys think?
Should companies be required to verify these requests through a completely separate channel before releasing sensitive customer data?
Source: Reuters — September 12, 2026
https://www.reuters.com/legal/litigation...026-09-12/
Revolut has confirmed a pretty wild data breach involving attackers who apparently didn’t need to hack Revolut’s systems at all.
According to Reuters, Revolut received fraudulent requests for customer information that appeared to come from a legitimate government agency email domain. Revolut believed the requests were genuine and disclosed sensitive customer information to an unauthorized third party.
Other reports say the information exposed to the attackers included data such as:
- [] Passport / identity documents[] Verification selfies[] Residential addresses[] Account information
- Bitcoin transaction records
The fraudulent request reportedly came through an actual government agency domain, making it much more convincing than a basic spoofed email.
Revolut later discovered that the request was unauthorized after contacting the government agency.
Revolut says affected customers have been notified, and the company has also contacted law enforcement, regulators and the government agency involved.
What’s interesting about this one is that there apparently wasn’t some complicated exploit or zero-day involved. The attackers essentially targeted the process Revolut uses to respond to government information requests and managed to convince the company to hand the information over voluntarily.
Makes you wonder how many companies actually independently verify government data requests before releasing customer information.
What do you guys think?
Should companies be required to verify these requests through a completely separate channel before releasing sensitive customer data?
Source: Reuters — September 12, 2026
https://www.reuters.com/legal/litigation...026-09-12/
![[Image: HF-Sig.jpg]](https://xtremediscount.net/Images/HF-Sig.jpg)
