Revolut data breach exposes passport and Bitcoin records

Data breach reported at Revolut: Customer records were illegally obtained

Revolut reportedly disclosed a data breach. In this incident, customer records, including passports, account statements and Bitcoin transaction history, were handed over to an unauthorized party posing as a government agency. According to publicly circulated customer notices, the Revolut data breach involved the disclosure of sensitive records rather than confirmed customer account breaches or stolen funds.

Key Information Summary

• Revolut reportedly disclosed a data breach that affected customer records.
• The report states that the types of data involved include passports, account statements and bitcoin-related records.

Disclosure details of the data breach

The report of the Revolut data breach originated from a report published by Lawrence Mondal on September 12, 2026 on crypto.news. The report described a so-called customer notice that some records were disclosed after receiving a fraudulent government agency request. It should be emphasized that the report only verified the published content and did not confirm the authenticity of the underlying notice.

According to unconfirmed reports, the notice was publicly shared by online investigator ZachXBT. The notice stated that the request came from an unauthorized account that used the email domain name of an official government agency and passed the domain name certification check. The materials currently surfaced do not specify which institution it is.

According to reports, the customer alert email was sent on September 11, 2026, but the notice shown did not provide a specific date for the basic request or disclosure. It is currently impossible to independently confirm whether Revolut has released an official accident page, filing documents or post-event analysis report.

Exposure data covers passports, statements, and Bitcoin records

According to ZachXBT or the notices it shared, the data categories in the report range from identity documents (such as passport or driver's license copies), verified selfie photos, account statements, IBAN (International Bank Account Numbers), withdrawal records, and a complete transaction history including Bitcoin activity. However, the materials do not establish that each of the above categories applies to every affected customer.

In the report at crypto.news, the Bitcoin wallet reference number appears on the listed account statements, while biometric facial telemetry data is described as not involved. These are attributed to the content of the notification rather than the results of an independently certified investigation.

The exposure of transaction records is a "record disclosure" event and is not conclusive evidence of account takeover. There are no indications in existing reports that Bitcoin has been stolen, private keys or mnemonics have been leaked, and no password has been compromised. Readers should not infer the status of wallet balances, addresses, or vouchers from the fact that "Bitcoin records" are mentioned. This is crucial for users who keep Bitcoin in custodians: The exposure of a statement listing past activities is a privacy failure, not a loss of self-custodial control. This is one of the reasons why some users tend to repeatedly purchase Bitcoin and withdraw it into their personal wallets.

Such data disclosures, when combined with identity documents and financial history, create downstream phishing and social engineering risks. This model has also occurred when a merchant side defect caused Bitcoin security to be exposed at the payment layer, rather than at the protocol layer. The Bitcoin network itself is not affected by the way the custodian handles data.

Scope of leaks and response details to be verified

In existing materials, several key facts have not yet been verified: the number of affected customers, the time interval between fraudulent requests and notifications, access methods, and the exact scope of the record. PANews quoted ZachXBT as saying that the affected group may be limited and high-net-worth users may be the main target, but there is no specific number confirmed by the company.

No confirmed containment steps, customer guidance or regulatory notification have been received. Therefore, any description of the Revolut response should await the emergence of first-party evidence. These are missing links in existing reports and do not mean that Revolut deliberately concealed details.

According to the UK Information Commissioner's Office (ICO) regulations, unauthorized disclosure of personal information or sending of personal data to wrong recipients meet the definition of personal data disclosure and therefore constitutes a violation without a system intrusion. Wherever feasible, certain disclosures that must be reported must be reported within 72 hours of knowledge, and high-risk individuals must also be notified without undue delay. This is a general rule from which no conclusions can be drawn regarding Revolut's jurisdiction, compliance or liability.

According to reports, this disclosure has no clear connection with Bitcoin's market behavior, and market fluctuations point more to background conditions than to reactions to this incident. The network's monetary attributes, fixed circulation, and self-custody model have not been affected by the custodian's data processing. Previous cases of Blockstream's refusal to pay ransom for Liquid-related losses also show that custody risks and sidechain risks are separated from the security of base-level Bitcoin.

Disclaimer : This article is for information purposes only and does not constitute financial or investment advice. There are significant risks in the cryptocurrency and digital asset markets. Be sure to conduct independent research before making a decision.