Revolut: Passports, KYC Selfies, and Bitcoin History Handed to an Attacker Impersonating a Government Agency

> TL;DR: Revolut, which claims more than 80 million customers across 160 countries (including 800,000 businesses), has notified a data breach to a subset of customers. An attacker impersonating a government agency requested personal data by email, using that agency's domain with valid domain authentication credentials — the request "was fulfilled under the reasonable belief that it was an authentic government agency request," per the company. The data handed over includes identity details (full name, date of birth, occupation), contact details, copies of identity documents (passport and/or driver's license), KYC facial verification selfies, account statements with IBANs, and full transaction history — including Bitcoin. The number of affected customers is undisclosed; investigator ZachXBT indicates targeting of high-net-worth users. Revolut says its systems and customer funds are unaffected.

The mechanism: institutional phishing that worked

The attack crosses no technical barrier: it exploits a business process. Fintech compliance teams routinely receive official requests (judicial inquiries, subpoenas, regulatory demands) by email. Here, the attacker used a real government domain with valid domain authentication credentials — the channel looked authentic in the technical sense, and the request was executed.

The result is a leak in the worst category: complete identity documents, facial verification biometrics, contact details, IBANs, and full transaction history. For high-net-worth targets — ZachXBT's thesis — this complete dossier is the ideal toolkit for identity theft, targeted banking fraud, and reconnaissance ahead of physical or digital attacks.

Revolut blocked the address on detection and alerted the relevant agency, law enforcement, data protection authorities, and financial regulators. This is the company's second major breach after September 2022 (50,150 customers).

Why this matters to you

If you run an HR, payroll, or finance SaaS, you hold the same role as Revolut: a custodian of massive personal data that answers official requests — and internal requests (HR, managers, support) that mimic the same channels. Three direct lessons:

What to do

The broader lesson

The two biggest leaks of the fortnight — Revolut and Florida's DAVID — were not opened by injection flaws or memory exploits, but by subverted trust channels (a convincing official-looking email, a stolen institutional account). The fastest-growing attack surface is not your code; it is your organization — the processes by which legitimate humans release data. Auditing them, through targeted social-engineering tests on disclosure workflows, is now as important as testing your endpoints.