Revolut's September: two leaks, no systems hacked

Revolut customers have had a rough September. On 12 September the fintech confirmed that it had handed customer data to criminals who had asked for it using a real government agency's email domain. Less than a fortnight later, customer notices started landing about a second, unrelated leak, this time at DriveWealth, the US brokerage that once handled Revolut's share trading.

Neither incident involved anyone breaking into Revolut's own systems. That's the point Revolut keeps making. It's also, in a way, the problem.

Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.
— Revolut spokesperson, speaking to TechCrunch

The request that looked official

According to Revolut, someone sent requests from a genuine government agency email domain, and Revolut staff processed them before spotting the fraud. Revolut hasn't said which agency or which country.

What went out of the door was not trivial. TechCrunch and Malwarebytes report that it included names, dates of birth, addresses, email addresses and phone numbers, copies of passports and driving licences, and possibly verification selfies, account statements and transaction histories. The Register reports that the attackers then posted on Telegram demanding 10,000 Bitcoin, roughly $782 million, and threatening to release more data every day until Revolut paid.

Revolut says only a "limited" number of customers were affected and that customer funds were not touched. In a statement it said: "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators." It hasn't published a number.

Then a second leak, from an old partner

The DriveWealth incident is different in kind. The US brokerage says an intruder got into its network on 4 and 5 September through what it called a "sophisticated social engineering campaign". The stolen data was historic: records from when Revolut customers' US share trading ran through DriveWealth directly.

Crowdfund Insider reports that this covers US customers who used Revolut's US share trading, plus older records for customers in the UK, the European Economic Area and Australia. Revolut changed its trading model between December 2023 and June 2025, depending on the market, and stopped sending individual customer details in those regions to DriveWealth after that. BeInCrypto reports that customers of other apps built on DriveWealth, including Stake and Hatch, were also caught up.

The exposed fields were names, email addresses, phone numbers, postal addresses, employment details, citizenship, age, gender and partial DriveWealth account numbers. DriveWealth says "Passwords and payment information, including credit card and bank account details, were not compromised."

Why this matters more now Revolut is a proper UK bank

Revolut won its full UK banking licence from the Bank of England's Prudential Regulation Authority in March, and RTÉ reported at the time that it had 13 million UK customers. Chief executive Nik Storonsky called the UK "our home market and central to our growth".

Being a bank means being held to a bank's standards. Handing passports and selfies to someone because their email address looked right is exactly the kind of process failure that matters more than any firewall. And the DriveWealth leak is a reminder that your data can outlive your relationship with a company's supplier by years. Britain's data watchdog, itself in the middle of becoming the Information Commission, will have plenty to think about.

If you're a Revolut customer, or were one when it used DriveWealth, the practical advice from Revolut and Malwarebytes is sensible:

• Treat any unexpected call, text or email "from Revolut" as suspect, and don't use links or numbers it gives you.
• Check your balances, cards, saved payees and linked devices in the app.
• Keep an eye on your credit report for applications you don't recognise.
• Report anything odd through the in-app chat, not a number someone sends you.

To be fair to Revolut

Impersonating a real government agency from a genuine domain is a nasty trick, and every bank that handles lawful data requests is exposed to it. Revolut says it contacted affected customers individually and told them exactly what had been exposed, which is better than a vague banner on a website. On DriveWealth, the data sat with a separate US company Revolut had already moved away from, and no passwords, card details or ID documents were taken.

Mind the hype. "Our systems weren't breached" is true. So is "your passport was".

Sources: TechCrunch, The Register (fake requests), Malwarebytes, The Register (DriveWealth), Crowdfund Insider, BeInCrypto, RTÉ