Revolut data breach: When the wrong agency comes asking

Revolut released customer data because requests looked like official information demands. The company confirmed the incident on 12 September to Reuters: an unauthorised third party had used an email address under a genuine government domain. That puts a question at the centre which goes beyond the security of a banking app: how does a bank verify who is entitled to demand private records?

What is documented – and what the attackers claim

The Financial Times reported around 680 affected customers. In its report on the suspected perpetrators, it says, citing them, that most of those affected came from Switzerland and France. The attackers claim to have obtained data over months via a compromised Italian government email system. No independently confirmed breakdown for Switzerland is included in the sources evaluated here. So "680 affected customers" does not become "680 Swiss victims".

The FT names identity and address data, among other things, as information that was exposed. According to the FT's report, Revolut stated that its own systems and customer funds were safe. That statement is relevant, but it answers a different question: data can lose its confidentiality without money simultaneously disappearing from an account.

Accuracy is also required on the extortion claim. Reuters reported on 16 September about a three-million-dollar demand described by the FT. Revolut said in response that it had neither been contacted directly nor received a direct demand. A publicly circulated threat and a payment demand received by the company are not the same thing.

A well-known weak point in dealings with authorities

As early as 4 November 2024, the FBI warned in a public notice about exactly this class of attack: criminals were using compromised US and foreign government email accounts to send fraudulent emergency data requests to US companies. In such procedures, the claimed urgency creates additional pressure to hand over information quickly.

The warning does not document the specific sequence of events at Revolut. It does show, however, that the underlying danger has been documented for years. A genuine domain alone does not confirm that the person behind it is authorised, or that the content of a request is accurate.

The FBI advises recipients to check, among other things, the legal bases cited, and conspicuous signatures and logos, for plausibility. If in doubt, they should check back with the sender and the responsible authority. The notice also documents a rejected fraudulent request to PayPal. Such attacks therefore do not have to succeed.

For Revolut, concrete questions remain: what checks took place before the data was released? Was the responsible body independently verified? And was it checked whether the scope and content of the requested data matched the stated purpose? The public statements evaluated here do not answer these questions.

Swiss expansion needs verifiable trust

The incident falls at a time when Revolut wants to expand its role in Switzerland. On 16 September the company announced that it had applied to FINMA for a Swiss banking licence. More than 150 million Swiss francs are to be invested over five years. Both are company statements; the investment is an announcement, not an amount already spent.

According to its own account, Revolut has more than 1.3 million customers in Switzerland. These are currently served by Revolut Bank UAB, which is licensed in Lithuania. The planned Swiss bank would create a new local structure. According to Revolut, the process is pending and its outcome open.

A licence announcement, however, does not clear up a data incident. Conversely, the data leak alone does not allow any reliable conclusion about the later FINMA decision. For customers, what counts for now is transparent information about which of their own records are affected and what checks should in future prevent another release.