Summary

• DriveWealth, a US brokerage infrastructure provider and Revolut’s stock trading partner, reported unauthorized access to historical personal data.
• Revolut emailed potentially affected customers and confirmed that a separate email from DriveWealth LLC was genuine.
• The affected data relates to customers who traded US stocks through Revolut before December 2023, which means some records were kept since 2022.
• The case raises questions about cross-border jurisdiction and about data minimization under the EU General Data Protection Regulation (GDPR).
• Breach notification emails are a common template for follow-up phishing, so customers should verify any security updates through the official app.

What happened in the DriveWealth security incident?

DriveWealth confirmed unauthorized access to historical personal data stored on its systems, and Revolut notified customers who may be affected. The incident came weeks after Revolut handled a separate attack in which a fake government request led to the release of customer passports.

PhishFort reviewed a notification Revolut sent to a potentially affected user. Titled “DriveWealth security incident update”, it states that unauthorized access to historical personal data occurred on DriveWealth’s systems and that Revolut is working directly with DriveWealth to determine the scope.

The notice tells the user they were identified as being potentially affected and adds: “You recently received an email from DriveWealth LLC… That email is genuine and you should read it carefully alongside this one.”

This is the DriveWealth email the notice refers to:

Who is affected by the DriveWealth breach?

The affected group is Revolut customers who traded US stocks before December 2023, according to the information shared with customers. Revolut has not published the total number of affected users. Customers who received both the Revolut and the DriveWealth emails should treat themselves as affected.

How did Revolut and DriveWealth communicate the incident?

Both companies contacted affected customers directly by email. Revolut also placed a visible alert on its website and published a help page about the incident.

DriveWealth published a standalone cyber response page on a subdomain (legal.drivewealth.com). At the time of PhishFort’s review, the page was not linked from DriveWealth’s main navigation, which makes it harder for customers to confirm the notice is real.

Why does a partner’s breach expose a fintech’s customers?

A fintech’s customers are exposed wherever their data is stored, including at brokers, payment processors and identity verification vendors. A US broker that executes trades for a European digital bank holds names, addresses and account details of the bank’s customers, so a breach at the broker reaches them directly.

This is a common pattern. The Verizon 2026 Data Breach Investigations Report (DBIR) found third-party involvement in 48% of breaches.

What are the jurisdiction and GDPR questions?

The incident raises an open question about which rules apply: Lithuanian and EU law, where Revolut holds its European banking license, or US frameworks that govern DriveWealth. The answer affects notification deadlines, regulator involvement and customer remedies.

Retention is the second question. If records from as early as 2022 were still held, the case tests the GDPR principle of data minimization, which limits how long personal data can be kept. Financial institutions often cite legal and regulatory duties to retain records, but those duties do not cover every field indefinitely.

How do attackers exploit breach notification emails?

Attackers copy real breach notices because customers expect them and act on them. After a public incident, fake “security update” emails, SMS messages and support accounts often reuse the real subject line, logo and wording, then point to a lookalike domain that asks for login details or identity documents.

Revolut’s notice confirmed that the DriveWealth email was genuine, which helps. A copy of either message can still target a customer. Warning signs include:

• A link that asks you to log in, “verify” your identity or reset your account from the email itself.
• A sender domain that is similar to, but not exactly, revolut.com or drivewealth.com.
• Requests for passwords, one-time codes, card details or ID photos.
• Unsolicited calls or chat messages that reference the incident.

Customers should open the Revolut app directly to check any security notice.

What should fintechs do about third-party risk?

Fintechs can reduce partner risk by limiting what partners hold and planning the customer response before an incident. Practical steps:

1. Map which partners store customer data, which fields and for how long.
2. Set contractual retention limits and deletion obligations that match GDPR data minimization.
3. Agree breach notification timelines and a joint communication plan with each partner.
4. Publish incident pages on the main domain and link them from the homepage, so customers can verify notices.
5. Monitor for lookalike domains and fake support accounts that use the incident as a lure.

How PhishFort helps after a third-party incident

When a partner is breached, attackers impersonate both brands. PhishFort Brand Protection detects lookalike domains, fake support accounts and fake apps that use the incident as a lure, and takes them down with registrars, hosts and platforms.

Frequently asked questions

Was Revolut hacked in the DriveWealth incident?

No. The unauthorized access happened on the systems of DriveWealth, Revolut’s US stock trading partner. Revolut notified potentially affected customers and said it is working with DriveWealth to determine the scope.

Who is affected by the DriveWealth breach?

According to information shared with customers, the incident affects Revolut users who traded US stocks before December 2023. Revolut has not published the total number of affected users.

Is the DriveWealth breach email real?

Revolut told customers that the email from DriveWealth LLC is genuine. Copies of breach notices are a common phishing lure, so check any security notice inside the Revolut app rather than through email links.

What is third-party risk in fintech?

Third-party risk is the exposure a fintech takes on when partners such as brokers, processors or verification vendors store or process its customers’ data. A breach at the partner affects the fintech’s customers even if the fintech’s own systems are secure.

Sources

• DriveWealth cyber response page
• Revolut Help Center: DriveWealth data incident
• Revolut customer notification “DriveWealth security incident update”, reviewed by PhishFort, September 2026.
• Verizon 2026 Data Breach Investigations Report (DBIR).

Summary

• Nexus, advertised on the Russian-language cybercrime forum Exploit, claimed documents for more than 170 million people in North America.
• The listing included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents and about 579,000 medical cards.
• Some records included front and back images plus infrared (IR) and ultraviolet (UV) scans, the imagery ID verification systems use to validate physical documents.
• Timestamps on stolen images matched ID scans at Hertz rental counters and a Planet13 dispensary, pointing to IDScan.net as the likely source.
• Nexus went offline after the report, but the data is likely to resurface. Organizations that rely on ID documents should expect more convincing fraud and phishing.

What happened in the IDScan.net and Nexus leak?

Nexus, a new identity theft service on the Exploit forum, sold searchable access to identity documents and claimed it had been continuously exfiltrating new data for more than a year. Security journalist Brian Krebs reported that the number of listed licenses grew by nearly 400,000 in 24 hours, which suggests an ongoing compromise rather than a one-time leak.

Krebs began investigating after a source told him his own Virginia driver’s license was being offered as a free sample. By matching image timestamps with the dates and times people had their IDs scanned at Hertz counters and a Planet13 dispensary, he traced the apparent source to IDScan.net, a Louisiana-based identity verification company. TechCrunch also reported that the evidence pointed to a breach of a major ID verification service.

The listing claimed:

• More than 153 million driver’s licenses.

• More than 10 million ID cards.

• More than 3 million travel or international identity documents.

• About 579,000 medical cards.

  

Leaked data breakdown

Shortly after the KrebsOnSecurity report, Nexus replaced its login page with the message “This service is no longer available.”

Who is investigating, and what are the lawsuits about?

The FBI’s New Orleans field office opened an inquiry into the incident. Krebs reported that records of high-ranking US government officials, reportedly including Defense Secretary Pete Hegseth, appeared in the dataset.

Consumers in California, Florida, Georgia and Louisiana filed lawsuits alleging that IDScan.net failed to protect sensitive data and likely violated Federal Trade Commission (FTC) data security guidelines. The plaintiffs seek damages and court-ordered security improvements.

Why are identity verification vendors such attractive targets?

An identity verification vendor processes ID checks for thousands of businesses, so one compromise exposes all their customers. Attackers do not need to breach every rental counter, hotel or dispensary. They only need the shared service behind them.

Partners of ID Scan

ID scanning is now routine in car rentals, hotels, dispensaries, financial services, age-restricted platforms, travel and marketplace onboarding. Each use reduces fraud at the counter but adds to a central store of sensitive data. The more trust and scale a provider accumulates, the more valuable a compromise becomes.

Why is a leaked driver’s license worse than a leaked password?

A password can be reset, but a driver’s license bundles a legal name, date of birth, address, photo, document number and issuing authority that a person cannot easily change. Many organizations still treat it as strong proof of identity.

Replacing the license changes the document number, but the exposed image and personal details can still be abused. That is why the impact of an ID document leak lasts much longer than a credential leak.

What can attackers do with stolen ID scans?

Stolen ID scans give attackers verified personal details they can use to pass weak checks and make impersonation believable:

1. Account opening fraud: submitting stolen document images to open accounts or apply for credit.
2. Account recovery attacks: sending a matching ID image to a support team to take over a victim’s account.
3. Targeted phishing: using real names, addresses and license details to make messages look legitimate, especially when combined with other breach data.
4. Executive and public figure targeting: using exposed IDs of executives and officials for impersonation, doxxing or physical security threats.
5. Bypassing weak KYC (Know Your Customer) checks: reusing images where verification only checks that a document looks valid, without liveness, device or behavior signals.

What should organizations that collect ID documents do now?

Organizations that collect or rely on ID documents should reduce what they store and assume the leaked data will be used against their customers. In order of priority:

1. Review what you collect. If the business only needs a verification result, do not keep the document image.
2. Minimize retention. Set clear retention windows and delete raw images once legal, compliance or fraud review needs end.
3. Reassess vendor exposure. Ask verification providers what they store, for how long, whether they keep raw images, whether they support deletion or tokenized verification, and how they log and monitor access.
4. Strengthen account recovery. Do not accept a government ID alone. Combine known-device checks, recent activity, step-up authentication and manual review for high-risk cases.
5. Monitor for impersonation. Watch for lookalike domains, fake support portals, executive impersonation, fraudulent onboarding attempts, social media impersonation and credential harvesting pages that use breached personal data.
6. Prepare customer guidance. Explain what happened, what data may be at risk and what people can realistically do.

What should individuals do if their ID may be exposed?

People who think their license may be in the dataset should focus on blocking new-account fraud and spotting targeted phishing:

• Place a credit freeze with the major credit bureaus.
• Monitor bank accounts and credit reports.
• Be skeptical of messages that contain accurate personal details.
• Watch for account recovery notices you did not request.
• Use unique passwords and multi-factor authentication (MFA) on important accounts.
• Report suspected identity theft at IdentityTheft.gov in the US or through the Office of the Privacy Commissioner of Canada.

How PhishFort helps after an identity data leak

Leaked identity data makes brand and executive impersonation more convincing. PhishFort Executive Protection detects and removes fake profiles and doxxing that target executives, and PhishFort Dark Web Monitoring watches underground sources for credential and identity data tied to your brand.

Frequently asked questions

Was IDScan.net hacked?

KrebsOnSecurity traced the Nexus data to IDScan.net by matching image timestamps with real ID scans at Hertz and a Planet13 dispensary. The FBI’s New Orleans field office opened an inquiry, and consumer lawsuits allege the company failed to protect the data.

How many driver’s licenses were exposed in the Nexus leak?

Nexus claimed more than 153 million US and Canadian driver’s licenses, plus more than 10 million ID cards, 3 million travel documents and about 579,000 medical cards, covering more than 170 million people.

What can criminals do with a scanned driver’s license?

Criminals can use stolen license scans to open accounts, pass weak KYC checks, take over accounts through support teams and make phishing messages more believable. Executives and officials face added impersonation and physical security risks.

Does getting a new driver’s license protect me?

Only partly. A new license changes the document number, but the leaked image, name, address and date of birth can still be used for fraud, so credit freezes and monitoring remain important.

Sources

• KrebsOnSecurity: FBI probes service selling 153M driver’s licenses
• TechCrunch: It sure looks like hackers breached a major ID card verification service (September 2, 2026)
• USA.gov: Identity theft
• Office of the Privacy Commissioner of Canada: Identity theft guide