A limited number of Revolut customers had sensitive information disclosed as part of a scam involving an unauthorised third party that used a legitimate government email domain, the financial technology company said.
Revolut said it detected the scheme, blocked the email address involved and notified the relevant government agency, law enforcement authorities, data protection officials and financial regulators.
“Revolut systems and customer funds are unaffected,” a company spokesperson said by email. “We have contacted the limited number of impacted individuals directly to inform them and provide support.”
Technology publication TechCrunch first reported the incident.
Revolut has not disclosed which government email domain was used, how many customers were affected or what type of information was exposed. The company also has not said when it identified the scam or how long the unauthorised disclosure continued.
The incident raises questions about the security of customer information handled through third-party systems, particularly as financial technology companies expand their operations across international markets.
Guidance from the UK’s Information Commissioner’s Office says organisations should report a personal data breach to the regulator as soon as possible, and where feasible within 72 hours, when the incident is likely to pose a risk to people’s rights and freedoms. Where the risk is considered high, affected individuals should also be informed without undue delay.
The disclosure comes as Revolut continues a major international expansion. The London-based company says it has more than 80 million customers worldwide and is targeting 100 million. It was valued at $115 billion following a share sale in July.
The United States is a major focus of its growth strategy. Revolut received conditional approval in early September to operate as a national bank in the US after applying for a banking charter in March. The company has committed $500 million to the American market over three to five years and has increased its marketing activity there.
Revolut also launched its first major banking operation outside Europe in Mexico in February.
In the UK, the company launched its bank in March after receiving approval from the Prudential Regulation Authority. The move allows Revolut to offer current accounts to its 13 million UK customers, with eligible deposits protected by the Financial Services Compensation Scheme up to £85,000 per person.
The company said at the time that it planned to invest £3 billion in the UK economy and create about 1,000 jobs.
The latest incident follows other cases involving customer information held by financial and commercial organisations being accessed through third-party providers.
HSBC warned some UK business banking customers in September 2025 that personal information submitted during account applications had been compromised through unauthorised access to an external platform. Harrods also disclosed a breach that exposed customer names and contact details held by a third-party provider.
Revolut has not identified the regulators it contacted or provided details about the assistance being offered to affected customers.
