British fintech giant Revolut is notifying a subset of users that their personal and financial information was compromised in a data breach.
Based in London, the neobank and financial technology company provides banking and investment services to over 80 million users in 160 countries and regions.
Late last week, the company informed a small number of users that their personally identifiable information (PII) was exposed to a third party posing as a government agency.
The exposed data, it said in emails to the affected users, included names, addresses, phone numbers, email addresses, dates of birth, occupation, copies of driver’s licenses and passports, and verification selfies.
Financial information, including IBANs, account statements, withdrawal records, and full transaction history, including Bitcoin, was also exposed.
The request carried valid technical domain credentials and was treated as an authentic agency inquiry. All financial institutions must comply with legal requests from law enforcement and government agencies.
Responding to a SecurityWeek inquiry, a Revolut spokesperson confirmed the incident.