Revolut says fraudulent government requests exposed customer data

The incident did not compromise Revolut’s systems or customer funds, but sensitive customer information was disclosed through fraudulent requests presented as official government demands. The available facts point to an abuse of trust and process rather than a conventional intrusion into the company’s core environment.

That makes the event relevant beyond Revolut: organizations that handle personal or financial data often receive legal, regulatory, or law-enforcement requests, and those workflows can become targets if authenticity checks are weak.

Customers who were notified should follow Revolut’s specific guidance and be alert for follow-on phishing, impersonation, account-recovery attempts, or messages that use exposed information to appear credible. Other companies should review how requests for customer data are received, authenticated, approved, and logged.

They should also confirm that staff have a trusted way to validate unusual requests, particularly when a request creates urgency or seeks information outside normal channels. The breach demonstrates that data protection depends not only on network controls, but also on the reliability of human and procedural verification.