British FinTech Revolut has confirmed that sensitive customer data was disclosed to an unauthorised third party after fraudulent requests were sent from a legitimate government agency email domain.

The company said the incident affected a “very limited” number of customers, who have been contacted directly, but it has not disclosed how many people were affected or identified the government agency involved. Revolut said it blocked the email address used in the fraud after detecting the incident.

The compromised information included customers’ dates of birth, postal and email addresses and phone numbers, as well as copies of identity documents such as passports and driving licences, according to the customer notification reviewed by TechCrunch. The notification said verification selfies, account statements and transaction histories may also have been exposed.

A Revolut spokesperson told TechCrunch that an “unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information”. The company said its systems and customer funds were unaffected.

Revolut said it alerted the relevant government agency, law enforcement bodies, data protection authorities and financial regulators after detecting the breach. The company has not said whether the incident was confined to a particular market.

The incident was highlighted publicly by crypto security researcher ZachXBT, who posted about Revolut’s notification to affected customers on Friday. ZachXBT said the breach appeared to have targeted high-net-worth users, although Revolut has not publicly confirmed that assessment.

London-based Revolut has more than 80 million customers globally and operates as a bank in more than 30 countries, according to its website. The FinTech has expanded into markets including India, Mexico, France and the UAE, while the US Office of the Comptroller of the Currency granted conditional approval earlier this month for it to establish a national bank in the US.

Revolut is meanwhile considering a potential public listing that could value the company at up to $200 billion, according to Reuters, substantially above its $75 billion private valuation in November 2025. The company has been expanding its banking operations in Europe and other markets as it prepares for further growth.

---