A limited number of Revolut customers had sensitive information disclosed in a scam involving an unauthorised third party that used a legitimate government email domain, the financial technology firm said yesterday.
The London-based firm said it blocked the address after detecting the scheme and alerted the “relevant government agency”, law enforcement, data-protection officials and financial regulators.
“Revolut systems and customer funds are unaffected,” a Revolut spokesperson said yesterday by email. “We have contacted the limited number of impacted individuals directly to inform them and provide support.”
TechCrunch earlier reported the breach yesterday.
Revolut did not identify the government email domain involved, the number of customers affected or the type of information disclosed. It did not say when it detected the scheme or over what period the disclosure took place.
Reporting rules
Guidance from the Information Commissioner’s Office states that organisations must report a personal data breach to the regulator as soon as possible, and where feasible within 72 hours, if there is a likely risk to people’s rights and freedoms. Where the risk to people is high, the ICO says those affected must also be told without undue delay.
The disclosure comes as Revolut expands its banking operations beyond Europe.
The company says it has more than 80 million customers globally and is targeting 100 million. It was valued at $115bn in a share sale in July.
Revolut has identified the United States as a key growth market. It received conditional approval in early September to operate as a national bank there, having applied for a US charter in March.
It has committed $500m to the US over three to five years and has stepped up its marketing in the country, including offering free subway rides to New Yorkers. In February, Revolut began its first major banking operations outside Europe, in Mexico.
UK banking operations
In the UK, Revolut launched its bank after approval from the Prudential Regulation Authority in March, allowing it to offer current accounts to its 13 million UK customers with deposits protected by the Financial Services Compensation Scheme up to £85,000 per person. The company said at the time that it would invest £3bn in the UK economy and create about 1,000 jobs.
Co-founder Nik Storonsky said then that launching the UK bank “has been a long-term strategic priority for Revolut and marks a significant moment” for the company.
The incident is the latest in which customer details held by a financial services provider have been exposed through activity outside a bank’s own systems.
In September 2025, HSBC warned UK business banking customers that passport details, identity documents, images and contact information submitted during account applications had been compromised through unauthorised access to a third-party platform. The bank said its own systems “are separate and have not been impacted” and offered affected customers a free 12-month identity monitoring subscription.
The same month, Harrods told customers that names and contact information had been taken after hackers accessed data held by a third-party provider, and said payment details and passwords were not exposed.
Revolut did not name the regulators it has informed or set out what support it is providing to the customers affected.
Amy Ingham
Amy Ingham is a reporter at Business Matters, covering UK business news with a focus on breaking news, business policy, late payments and insolvency. She joined the magazine in 2026 after completing the NCTJ Diploma in Journalism at Harlow College's journalism school. Her recent reporting includes British Steel's nationalisation and its impact on SME suppliers, the decline in late payments by large firms, and Insolvency Service director disqualifications. Reach her at aingham@cbmeg.co.uk.
