Revolut confirms sensitive customer data breach after fake government requests

Fintech company Revolut disclosed on Thursday that sensitive customer information was leaked to an unauthorized third party after receiving fraudulent requests from what appeared to be a legitimate government agency email address. The company is in the final stages of negotiations with the Bank of Israel to obtain a license to operate in the country.

Revolut spokesperson, who did not disclose the exact number of individuals impacted, stated that the breach did not affect the company's systems or customer funds. The compromised data included customers' birth dates, postal and email addresses, phone numbers, and copies of their identity documents such as passports and driver's licenses.

After extensive negotiations and delays due to the conflict and regulatory obstacles, Revolut is set to receive a license to operate in Israel as a "light" bank, offering additional financial services including accepting deposits and providing credit. Revolut recently formed a partnership with Uri Natan, the former CEO of Leumi's digital banking division, Pepper, to lead its Israeli operations.

The company aims to go public and reach a valuation of up to $200 billion, positioning itself as one of the most successful European fintech firms without any physical bank branches. This is not Revolut's first security breach; in 2020, criminal groups exploited a flaw in Revolut's payment systems to steal over $20 million from the company, taking advantage of discrepancies between the U.S. and European systems.