Fintech platform Revolut has reportedly disclosed that an unauthorized party posing as a government agency obtained sensitive customer records, including passport copies, verification selfies, account statements, IBANs, withdrawal records, and full transaction histories containing Bitcoin activity. The reported data breach came to public attention through blockchain investigator ZachXBT on September 12, 2026, after affected users received security alerts on September 11, 2026.
According to the circulated customer notice, the request originated from an email using an official government-agency domain and passed domain authentication checks, leading Revolut to treat it as legitimate. The available material does not specify the agency, the number of affected users, or the exact date of the disclosure. ZachXBT suggested the incident may be limited in scope and could have targeted high-asset users, but no company-confirmed figures have been released.
Revolut’s notice reportedly stated that biometric facial telemetry data was not involved. Crucially, the reporting indicates that there is no evidence of account takeover, theft of funds, or leakage of private keys, seed phrases, or passwords. The exposure of Bitcoin transaction histories is a privacy failure rather than a loss of self-custodial control, and the Bitcoin network itself is unaffected. Under UK Information Commissioner’s Office rules, unauthorized disclosure of personal data can qualify as a personal data breach, with certain incidents requiring notification within 72 hours; however, Revolut's specific compliance status remains unconfirmed.
