Revolut Disclosed Data on 680 Customers After Fake Government Requests

Revolut disclosed sensitive information belonging to 680 customers after cybercriminals used a legitimate government email account to submit fraudulent requests for customer data, according to a report by the Financial Times.

The exposed information @WuBlockchain included passport details, bank account numbers, home addresses, identity-verification images and Bitcoin activity. The attackers are now threatening to release the stolen information unless Revolut pays a ransom, according to the report.

Revolut Blocks Compromised Government Email Account

The incident involved fraudulent information markets requests that appeared to originate from a legitimate government email account. Rather than exploiting a conventional technical vulnerability to directly access customer systems, the attackers reportedly used the trusted status of the government account to obtain information from Revolut.

Revolut said it blocked the email account after identifying the fraudulent activity and notified regulators and affected customers.

The company is also facing scrutiny from the UK Information Commissioner’s Office, which has opened an investigation into the incident. The regulator’s involvement could place additional focus on how financial institutions authenticate data requests and protect sensitive customer information when dealing with external authorities.

Among those affected was former Mt. Gox CEO Mark Karpelès, highlighting the breadth of the customer information involved.

Customer Data Exposure Raises Security Concerns for Crypto Users

The incident carries particular significance for cryptocurrency users because the compromised information reportedly included Bitcoin activity alongside conventional financial and identity records.

Combining financial information with passport details, residential addresses and identity-verification images can create additional risks for affected individuals, particularly where attackers attempt to use the information for further fraud or extortion.

The episode also underscores a broader security challenge for financial technology companies: legitimate communication channels can themselves become tools for social engineering when attackers gain access to trusted institutional accounts.

Revolut’s response, including blocking the compromised account and notifying regulators and customers, will now be examined alongside the ICO investigation. The key outstanding issue is how the fraudulent requests were authenticated and whether additional safeguards will be required to prevent similar disclosures.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.