ZachXBT says Revolut may have exposed data after acting on a fake government request

Blockchain investigator ZachXBT said Revolut may have disclosed personally identifiable information after failing to detect a forged government data request. According to his post, the request appeared to come from a real government body and was sent through that agency’s official email domain. Because the message also carried valid domain authentication, Revolut reportedly treated it as legitimate and responded. The data that may have been exposed includes names, dates of birth, occupations, home addresses, email addresses, phone numbers, passport or driver’s license copies, identity verification selfies, account statements, IBAN details, withdrawal records, and full transaction histories, including Bitcoin transactions. In a notification sent to users, Revolut said no biometric facial telemetry data was leaked. ZachXBT added that the scope may be limited for now, but the affected group appears to be skewed toward high-net-worth users. Multiple Revolut users reportedly received security incident notices yesterday. Revolut had previously advised users to verify suspicious messages through in-app customer support and avoid sharing personal or financial information.