Revolut, one of Europe’s largest digital financial services companies, is facing a data breach after cybercriminals used a genuine government email account to impersonate officials and request customer information. The incident affected around 680 customers, with sensitive information including passport details, identity documents, home addresses, bank account numbers and cryptocurrency activity reportedly disclosed to the attackers.
The attackers did not need to break into Revolut’s core systems. Instead, they exploited trust in an official communication channel and persuaded the company to provide information through what appeared to be a legitimate government request. The incident shows how financial institutions can remain exposed even when their core technology and customer accounts are not directly compromised.
The attack centred on a legitimate government email account that had been obtained by the attackers. The criminals used the account to send fraudulent requests for information about Revolut customers while presenting themselves as government or law enforcement officials.
Revolut responded to the requests and disclosed sensitive customer information. According to reporting by the Financial Times, the information included passport details, identity cards, verification pictures, home addresses, bank account information and cryptocurrency activity. The company subsequently contacted 680 customers it believed had been affected.
A later report said hackers claimed to have compromised an Italian government email system used for secure legal communications. The attackers allegedly made repeated requests over several months and targeted customers with significant cryptocurrency holdings. The report said affected customers were mainly in Switzerland and France, although information relating to residents of 31 other European countries was also reportedly involved.
The attackers subsequently threatened to publish the stolen information unless Revolut paid a ransom. Revolut blocked the fraudulent email address and reported the incident to the relevant authorities. The company has maintained that its internal systems and customer funds were not compromised.
A Different Kind of Risk
The incident highlights a different type of cyber risk from a conventional system intrusion: the attackers exploited the process used to handle requests for customer information.
The Federal Reserve’s 2026 Risk Officer Report, based on a survey of more than 400 financial institution risk professionals, found that criminals were increasingly using impersonation, social engineering and credential compromise. It also identified business email compromise and account-holder scams as continuing concerns across payment channels.
Visa’s Spring 2026 threat report similarly found that criminals were shifting towards AI-enabled social engineering as payment security improved. Visa identified nearly $1 billion in scam-related activity between July and December 2025 and described scams as the largest category of consumer payment fraud in its network intelligence.
For a digital bank such as Revolut, this creates a particularly difficult control problem. Employees must respond to legitimate requests from regulators and law enforcement while also ensuring that customer information is not released to an impersonator. A genuine government domain or email address alone may therefore no longer provide sufficient proof that a request is authentic.
The Regulatory Response
The UK’s Information Commissioner’s Office has opened an investigation after Revolut reported the incident. The investigation remains ongoing, so there has been no regulatory finding that Revolut breached its obligations.
The ICO’s current guidance says organisations must have robust procedures for detecting, investigating and internally reporting personal data breaches. Where a breach is likely to create a high risk to individuals’ rights and freedoms, affected individuals should also be informed without undue delay.
Recent enforcement activity demonstrates the potential consequences of weaknesses in these controls. In August 2026, the ICO reprimanded the ACRO Criminal Records Office after a cyber incident potentially exposed information belonging to up to 10,920 people, including passport and bank account information. The regulator identified weaknesses in patch management, security monitoring and the investigation of security alerts.
Lessons for Financial Institutions
The Revolut incident demonstrates that identity verification needs to extend beyond the technology perimeter. Financial institutions increasingly need to establish whether the person making a request is genuinely authorised to receive customer information, even when the request appears to come from a trusted institution.
This could mean using independent verification channels for sensitive requests, applying additional approval requirements for unusually broad or sensitive data requests, and creating clear escalation procedures when a request involves identity documents, financial information or cryptocurrency activity.
The case also reinforces the importance of limiting the amount of information released in response to external requests. A request that is genuine should not automatically mean that every piece of available customer information is appropriate to disclose.
An IMF paper published in March 2026 found that financial-sector cyber events accounted for about 10% of cyber events across 20 sectors and 162 countries over the past decade. It also identified data breaches as a persistent outcome of cyber incidents affecting the financial sector.
Re-evaluating the Regulations to Fit Modern Technologies
The Revolut incident also raises a wider question about whether regulatory frameworks and security controls are keeping pace with the technologies being used by criminals. High-tech impersonation is becoming harder to detect as attackers combine stolen credentials, synthetic identities, deepfakes and AI-generated messages. The BIS has warned that frontier AI can reduce the time and expertise needed to carry out sophisticated cyber attacks, while also offering financial institutions new tools for vulnerability detection, threat monitoring and incident response.
Blockchain and decentralised identity technologies could form part of this next layer of defence. Instead of relying mainly on an email address or a document supplied by a requester, institutions could use cryptographically verifiable credentials to confirm who issued a request, whether the credential remains valid and whether the requester has the authority to access specific information. The BIS’s 2025 G20 TechSprint highlighted decentralised identifiers, verifiable credentials and blockchain-based systems as potential ways to create more trusted and privacy-preserving identity exchanges.
Hyperscale AI could provide another layer of protection by analysing huge volumes of communications, identity signals and behavioural patterns in real time. AI systems could flag unusual requests, compare a request against previous interactions, identify subtle signs of impersonation and automatically escalate high-risk cases for human review. Regulators are already exploring this approach. Singapore’s Monetary Authority, for example, is working with banks and public agencies to test AI models using cross-bank and public-private data to improve scam detection, while also encouraging financial institutions to use advanced AI for vulnerability discovery and cyber defence.
The regulatory challenge is therefore not simply to create stricter rules, but to ensure that those rules can adapt as the technology changes. The BIS has argued that digital innovation creates new vulnerabilities alongside its benefits and that regulatory and supervisory frameworks need to evolve to address emerging risks. Financial institutions similarly need to treat security as a continuous process rather than a fixed control framework. As criminals adopt new technologies, banks and fintechs must be able to test, update and replace their defences at a comparable pace, using technologies such as blockchain, advanced identity systems and AI not only to protect existing systems but to anticipate the next generation of attacks.
