Revolut said an unauthorized third party used an email address hosted on a real government-domain account to submit fraudulent requests for customer records, leading to the exposure of sensitive information belonging to a small number of users. The company described the incident as a "highly sophisticated external impersonation scam," adding that the related email account has been blocked and that its internal systems and customer funds were not affected. Data that may have been disclosed includes names, dates of birth, home addresses, email addresses, phone numbers, copies of passports and driver’s licenses, identity verification selfies, account statements, IBAN details, withdrawal records, and full transaction histories, including Bitcoin transactions. Former Mt. Gox CEO Mark Karpelès said he was among those affected. Revolut did not disclose how many customers were impacted, whether the case was limited to a single market, or which government body’s domain was abused. The firm said it has notified the relevant government authority, law enforcement, data protection agencies, and financial regulators.
Revolut said an unauthorized third party used an email address under a real government domain to file fraudulent requests for customer records, exposing sensitive information tied to a small number of customers.
The company described the case as a "highly sophisticated external impersonation scam." It said the related email account has been blocked and that its systems and customer funds were not affected.
What data may have been exposed
According to Revolut, the potentially disclosed information includes names, dates of birth, home addresses, email addresses, phone numbers, copies of identity documents such as passports and driver’s licenses, identity verification selfies, account statements, IBAN details, withdrawal records, and full transaction histories, including Bitcoin transaction records.
Known affected parties
Former Mt. Gox CEO Mark Karpelès said he was one of the affected individuals. Revolut did not disclose the number of impacted customers. It also did not say whether the incident was limited to a single market or identify the government entity whose domain was impersonated.
Response and outside assessment
The company said it has notified the relevant government body, law enforcement, data protection authorities, and financial regulators. On-chain investigator ZachXBT said the incident may be limited in scale, but suggested the targets may have been high-net-worth users.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
