Loading story…
Brokerage service provider DriveWealth disclosed that attackers gained unauthorized access to its internal network through a sophisticated social-engineering campaign on September 4–5, exposing historic personal data of some customers who used Revolut's US investment services. The affected records were retained by DriveWealth under regulatory obligations from the period when Revolut users held brokerage accounts directly with the provider, and may include identity, contact, employment, demographic and partial account-number information.
DriveWealth said passwords, payment-card and bank-account data, production brokerage and trading systems, and its client-facing platform were not affected, with no evidence of unauthorized transactions or account changes. Revolut said its own systems, core databases, customer funds, investments, passwords, passcodes, card details and identity documents were unaffected, and that it notified impacted customers. The disclosure follows a separate September phishing and impersonation incident in which attackers posed as a government agency to solicit customer data.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Revolut disclosed that criminals impersonating a legitimate government agency used a spoofed email domain to submit fraudulent information requests. The separate incident potentially exposed sensitive customer data for a limited number of customers.
An unauthorized party gained access to DriveWealth's internal network through a sophisticated social-engineering campaign and obtained historic personal data from certain internal systems. Former Revolut customers who used US stock investment services were among those affected.
Revolut began moving customers in the UK, EEA, and Australia away from its DriveWealth arrangement; the migrations continued through June 2025 depending on market. Revolut said personal details were no longer shared with DriveWealth after the applicable migrations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Revolut disclosed that it released sensitive customer information to an unauthorized party after receiving a fraudulent data request impersonating a legitimate government agency. The request reportedly originated from an unauthorized account using an official agency email domain with valid domain-authentication credentials, causing it to be treated as legitimate. The number of affected customers, the impersonated authority, and the precise failure path have not been publicly confirmed. The exposed records reportedly include passport or other KYC identity documents, facial-verification selfies, contact details, account statements, IBANs, withdrawal records, and full transaction histories, including Bitcoin-related activity. Revolut said its core systems, mobile app, customer accounts, and funds were not compromised; it blocked the email source, notified authorities, and contacted affected users. The combined identity and financial data creates elevated risks of identity fraud, targeted phishing and vishing, SIM-swapping, fraudulent account opening or direct debits, extortion, and persistent linkage between customer identities and blockchain addresses.
Sep 18, 2026
Revolut disclosed that it released customer information to a third party responding to fraudulent requests sent through a spoofed government email domain. Attackers allegedly used infostealer-compromised Italian Ministry of the Interior email accounts to monitor communications for months and issue fake European Investigation Orders seeking KYC records from Revolut’s Lithuanian-regulated entity. The actor calling itself **“IAmNotAVillain”** claims to possess personal, identity-verification, and financial data and has reportedly demanded a **$3 million** ransom, although Revolut said it received no direct demand and that customer funds and its core systems were unaffected. The stolen data has reportedly enabled a targeted SMS-phishing campaign against Revolut customers, including high-net-worth cryptocurrency users selected through blockchain-record analysis. Some smishing messages appeared within legitimate Revolut SMS threads and linked victims to counterfeit pages that mimicked the bank’s live-video identity-verification process before requesting account passwords. Revolut said it blocked the fraudulent address and notified authorities and regulators; customers should treat unsolicited identity-verification or password requests as phishing and verify communications through official Revolut channels.
Sep 25, 2026
A threat actor has advertised an alleged **Revolut** customer database for sale on a cybercrime forum, claiming it contains more than **75 million records** tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic. Revolut said it has found **no evidence of unauthorized access** or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around **May 2025**, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Jul 30, 2026