Revolut data breach

What happened

Revolut confirmed in September 2026 that it handed sensitive customer data to an unauthorized third party who sent fraudulent information requests from a legitimate government agency's email domain; because the emails carried valid domain authentication, Revolut treated them as genuine. According to its notices to customers, the data included names, dates of birth, occupations, postal and email addresses, phone numbers, passport and driver's license copies, verification selfies, account statements with IBANs, withdrawal records and full transaction histories. Revolut said a limited number of customers were affected and did not give a figure; Computing reported that it contacted 680 people. Revolut says its systems and customer funds were not affected, and the people claiming responsibility have demanded a ransom and posted samples online.

What should I do?

1. Expect targeted phishing and calls that know your transaction history; Revolut will not ask you to move money to a 'safe account' or share card details or passcodes.
2. Turn on every login and card security setting in the Revolut app and review linked devices.
3. Because passport or license copies were included, watch for accounts or loans opened in your name and consider a credit freeze or fraud alert where you live.
4. Report a stolen-identity concern to your national ID or license authority if you are told your documents are being misused.

Check the other services you use →