Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request.

Exposed data included:

  • Copy of passport and/or driver's licence, plus the verification selfie
  • Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
  • Full name, date of birth, occupation
  • Home address, email, phone number

While the incident is likely limited in size it seems to have been targeted at high net worth users. 

An email alerting users was sent out to multiple Revolut users yesterday.

Source: ZachXBT.

Revolut handed over customers’ passport copies, verification selfies and full transaction histories to a malicious actor
you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 2 months ago

So far, I haven't had to ID verify for anything. The moment I do it's immediately over. I will live like a 1700's hermit before I'll permit it.

  • source