Fintech Giant Revolut Confirms Data Breach Ahead of Israeli Market Entry

British fintech company Revolut has confirmed a significant data breach that exposed sensitive customer information to unauthorized parties. The incident occurred over the weekend when the company received fraudulent requests originating from an email domain verified as belonging to a government authority. A Revolut spokesperson told Reuters that while the company has blocked the fraudulent address and alerted relevant authorities, they did not specify if the breach was geographically targeted or name the specific government entity whose domain was impersonated. However, independent crypto security investigator ZachXBT suggested the attack was not random but specifically targeted high-net-worth users to obtain their financial profiles.

According to TechCrunch, the exposed data was extensive, including not only basic identification details like birth dates, addresses, phone numbers, and copies of identity documents such as passports and driver's licenses, but also sensitive financial information. This included IBANs, bank statements, and full transaction histories, with a notable amount of cryptocurrency activity like Bitcoin transactions. Revolut clarified that biometric data and login credentials were not compromised. The company stated that its systems and customer funds were not affected, but did not disclose the number of affected individuals.

The breach is considered unusual because it exploited the company's own compliance mechanisms. Attackers used a legitimate email address from an official government domain to submit false information requests. Because the domain passed Revolut's technical security checks, the company's team complied, leading to a failure in human verification processes. Analyst Max Carpiss debunked a rumor that a security employee was fired over the incident, clarifying it was a parody account and the rumor lacked factual basis. He noted the event serves as a stark reminder that sensitive data can be compromised through human error rather than a classic cyberattack.

This incident occurs as Revolut, which serves over 80 million customers globally and operates with a banking license in over 30 countries, is in the process of obtaining a "thin bank" license from the Bank of Israel to enter the Israeli market. Its entry is seen as a key opportunity to foster significant competition against major Israeli banks. The breach could potentially impact public perception in Israel and may lead the Bank of Israel's supervision department to toughen data security requirements for the license. Revolut also received a payment services license in Israel in July 2025, allowing it to handle money transfers, digital wallets, and offer interest on deposits.

Despite the security incident, Revolut continues its global expansion and financial growth. The company plans a public offering with a target valuation of up to $200 billion, a significant increase from its previous valuations. It has recently expanded into markets like India, Mexico, France, and the UAE, and received tentative approval from US regulators to launch its first US bank in the first half of 2027.