Revolut, Europe's most valuable startup, confirmed that it sent personal data of hundreds of customers to hackers who impersonated an Italian government agency email. The company pledged to cover costs for customers needing to replace identity documents following the breach.
- 680 customers had data exposed, including 55 in France
- Hackers exploited a spoofed email from Italian police
- Revolut will cover costs for ID document replacement
What happened
Revolut disclosed that hackers obtained hundreds of customers’ personal data after gaining control of an email address linked to the Italian government police in Reggio Calabria. The compromised address was never previously used, raising concerns about email system vulnerabilities in government agencies.
The company, which operates as a digital bank, sent sensitive information to the fraudulent email after a request, without sufficiently verifying the source. Approximately 680 customers were affected in total, including 55 based in France.
Why it matters
This incident highlights the risk of targeting trusted government channels in cyberattacks, exploiting weaknesses beyond the company’s own security systems. Revolut clarified that its internal platforms remained secure but acknowledged that partnering institutions can represent vulnerable links.
Financial institutions like Revolut are obligated to provide data to authorities during crime investigations, but this case shows how verification lapses can lead to unintended data exposure. Such breaches can cause significant customer harm and potential losses, prompting the firm to offer financial support for identity protection measures.
What to watch next
Revolut’s commitment to cover expenses for replacement identity documents of affected customers will be closely monitored, both for its financial impact and effectiveness in mitigating customer harm. The company has not reported any ransom demands or payments as part of this incident.
Regulatory scrutiny may increase around data-sharing procedures with government agencies, especially concerning verification protocols. Observers will also watch how Revolut and similar fintechs adapt their policies and partnerships to prevent attacks exploiting external system vulnerabilities.