Revolut Confirms Data Breach Ahead of Israeli Expansion

Fintech giant Revolut has confirmed a security incident where sensitive customer information was handed over to an unauthorized individual. The breach occurred as the company prepares to expand its operations in Israel, a move that has been progressing with approvals for integration into local payment systems and a banking license application. The attacker did not hack Revolut's systems directly. Instead, they used an email address from a legitimate government agency's domain to send requests for information that appeared to be official demands. Revolut believed these requests were authentic and disclosed the data itself.

The exposed information may include full names, birth dates, home addresses, phone numbers, email addresses, identification documents, and verification photos. In some cases, sensitive financial details were also compromised, such as account numbers, statements, withdrawal data, and transaction histories. Some customers' Bitcoin activity was also revealed.

Revolut emphasized that its internal systems were not breached and no customer funds were stolen. The company stated that a limited number of customers were affected but did not specify the exact number. Following the discovery, Revolut blocked the email address used for the requests, notified the relevant government body, and reported the incident to law enforcement and regulators. Affected customers have been directly notified.

While Revolut has not yet launched full banking operations for the general public in Israel, and there is no current indication that Israeli customers were impacted, the timing of the incident is particularly relevant to the country. The company, aiming to become a significant player in the local financial market, is now dealing with an event that highlights a failure in verifying sensitive information requests rather than a sophisticated technological breach. This method of obtaining data by tricking the company into self-disclosure makes the incident unusual.