Revolut Reveals Hackers Obtained Passport Images and Complete Transaction Histories Via Bogus Government Request

The London‑based fintech Revolut has acknowledged that a cyber breach revealed customers' passport photographs and their entire transaction logs after the firm complied with a counterfeit request posing as an official government body.

In its statement, the company explained that the misleading request seemed to originate from a legitimate authority, leading staff to release the data. A later probe showed that the information was captured by unauthorised parties, giving them access to highly sensitive personal documents and a complete ledger of users' financial activity.

Serving millions of customers throughout Europe and beyond, Revolut has marketed itself as a safe substitute for conventional banks. Yet the incident underscores the ongoing difficulty fintech companies encounter in protecting data from ever‑more advanced social‑engineering schemes. Although the firm has not revealed the precise count of compromised accounts, it stressed that the leaked material consists of passport copies and a comprehensive transaction record.

To address the situation, Revolut has initiated an internal forensic audit, hired outside cybersecurity specialists, and alerted the appropriate data‑protection regulators. The firm is also reaching out to impacted users, advising them to watch their accounts for any irregular activity and to contemplate updating their authentication details where needed. Further security steps, including tighter checks on external data requests, are being implemented to avert a repeat.

The breach comes as a wider surge of cyber attacks on financial institutions sweeps the globe, leading regulators to examine adherence to data‑privacy rules like the EU’s GDPR. Analysts warn that the episode may invite heightened regulatory scrutiny and possible fines should systemic flaws be uncovered. For customers, the incident is a cue to stay alert, routinely check account statements, and keep abreast of the security measures employed by the services they rely on.