Summary

• DriveWealth, a US brokerage infrastructure provider and Revolut’s stock trading partner, reported unauthorized access to historical personal data.
• Revolut emailed potentially affected customers and confirmed that a separate email from DriveWealth LLC was genuine.
• The affected data relates to customers who traded US stocks through Revolut before December 2023, which means some records were kept since 2022.
• The case raises questions about cross-border jurisdiction and about data minimization under the EU General Data Protection Regulation (GDPR).
• Breach notification emails are a common template for follow-up phishing, so customers should verify any security updates through the official app.

What happened in the DriveWealth security incident?

DriveWealth confirmed unauthorized access to historical personal data stored on its systems, and Revolut notified customers who may be affected. The incident came weeks after Revolut handled a separate attack in which a fake government request led to the release of customer passports.

PhishFort reviewed a notification Revolut sent to a potentially affected user. Titled “DriveWealth security incident update”, it states that unauthorized access to historical personal data occurred on DriveWealth’s systems and that Revolut is working directly with DriveWealth to determine the scope.

The notice tells the user they were identified as being potentially affected and adds: “You recently received an email from DriveWealth LLC… That email is genuine and you should read it carefully alongside this one.”

This is the DriveWealth email the notice refers to:

Who is affected by the DriveWealth breach?

The affected group is Revolut customers who traded US stocks before December 2023, according to the information shared with customers. Revolut has not published the total number of affected users. Customers who received both the Revolut and the DriveWealth emails should treat themselves as affected.

How did Revolut and DriveWealth communicate the incident?

Both companies contacted affected customers directly by email. Revolut also placed a visible alert on its website and published a help page about the incident.

DriveWealth published a standalone cyber response page on a subdomain (legal.drivewealth.com). At the time of PhishFort’s review, the page was not linked from DriveWealth’s main navigation, which makes it harder for customers to confirm the notice is real.

Why does a partner’s breach expose a fintech’s customers?

A fintech’s customers are exposed wherever their data is stored, including at brokers, payment processors and identity verification vendors. A US broker that executes trades for a European digital bank holds names, addresses and account details of the bank’s customers, so a breach at the broker reaches them directly.

This is a common pattern. The Verizon 2026 Data Breach Investigations Report (DBIR) found third-party involvement in 48% of breaches.

What are the jurisdiction and GDPR questions?

The incident raises an open question about which rules apply: Lithuanian and EU law, where Revolut holds its European banking license, or US frameworks that govern DriveWealth. The answer affects notification deadlines, regulator involvement and customer remedies.

Retention is the second question. If records from as early as 2022 were still held, the case tests the GDPR principle of data minimization, which limits how long personal data can be kept. Financial institutions often cite legal and regulatory duties to retain records, but those duties do not cover every field indefinitely.

How do attackers exploit breach notification emails?

Attackers copy real breach notices because customers expect them and act on them. After a public incident, fake “security update” emails, SMS messages and support accounts often reuse the real subject line, logo and wording, then point to a lookalike domain that asks for login details or identity documents.

Revolut’s notice confirmed that the DriveWealth email was genuine, which helps. A copy of either message can still target a customer. Warning signs include:

• A link that asks you to log in, “verify” your identity or reset your account from the email itself.
• A sender domain that is similar to, but not exactly, revolut.com or drivewealth.com.
• Requests for passwords, one-time codes, card details or ID photos.
• Unsolicited calls or chat messages that reference the incident.

Customers should open the Revolut app directly to check any security notice.

What should fintechs do about third-party risk?

Fintechs can reduce partner risk by limiting what partners hold and planning the customer response before an incident. Practical steps:

1. Map which partners store customer data, which fields and for how long.
2. Set contractual retention limits and deletion obligations that match GDPR data minimization.
3. Agree breach notification timelines and a joint communication plan with each partner.
4. Publish incident pages on the main domain and link them from the homepage, so customers can verify notices.
5. Monitor for lookalike domains and fake support accounts that use the incident as a lure.

How PhishFort helps after a third-party incident

When a partner is breached, attackers impersonate both brands. PhishFort Brand Protection detects lookalike domains, fake support accounts and fake apps that use the incident as a lure, and takes them down with registrars, hosts and platforms.

Frequently asked questions

Was Revolut hacked in the DriveWealth incident?

No. The unauthorized access happened on the systems of DriveWealth, Revolut’s US stock trading partner. Revolut notified potentially affected customers and said it is working with DriveWealth to determine the scope.

Who is affected by the DriveWealth breach?

According to information shared with customers, the incident affects Revolut users who traded US stocks before December 2023. Revolut has not published the total number of affected users.

Is the DriveWealth breach email real?

Revolut told customers that the email from DriveWealth LLC is genuine. Copies of breach notices are a common phishing lure, so check any security notice inside the Revolut app rather than through email links.

What is third-party risk in fintech?

Third-party risk is the exposure a fintech takes on when partners such as brokers, processors or verification vendors store or process its customers’ data. A breach at the partner affects the fintech’s customers even if the fintech’s own systems are secure.

Sources

• DriveWealth cyber response page
• Revolut Help Center: DriveWealth data incident
• Revolut customer notification “DriveWealth security incident update”, reviewed by PhishFort, September 2026.
• Verizon 2026 Data Breach Investigations Report (DBIR).

Summary

• Revolut fulfilled fraudulent data requests that came from an unauthorized email account created inside a legitimate government agency domain.
• The requests passed SPF, DKIM and DMARC checks, the standard email authentication controls used to block spoofed email.
• Exposed data included identity documents, onboarding selfies, IBANs, wallet references and full transaction histories, including Bitcoin activity. Passwords, private keys and full card details were not shared.
• Revolut said systems and customer funds were not affected and notified a limited number of customers, regulators and law enforcement.
• The attack targeted a process (how data requests are verified), not a system. Out-of-band verification is the control that would have stopped it.

What happened in the Revolut data disclosure incident?

Revolut treated a fraudulent information request as a genuine request from a government agency and sent sensitive customer data in response. The request came from an unauthorized email account created within the agency’s real domain infrastructure, carried valid domain authentication and passed SPF, DKIM and DMARC.

Customer notices began circulating on September 11, 2026. Blockchain investigator ZachXBT and former Mt. Gox CEO Mark Karpelès helped bring the notices into public view, and crypto media covered the story on September 12. Revolut later confirmed the incident to media outlets.

A Revolut spokesperson described it as “a sophisticated external impersonation attack where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information.” After detection, Revolut blocked the sender and alerted the agency, law enforcement, data protection authorities and financial regulators.

Revolut has not disclosed how many customers were affected or which agency’s domain was abused, citing an ongoing police investigation. On-chain researchers said the affected group appears small and skewed toward higher net worth individuals.

What customer data did Revolut share?

According to the customer notices, the disclosure package included:

• Full names, dates of birth, occupations, postal addresses, email addresses and phone numbers.
• Copies of identity documents (passports or driver’s licenses).
• Verification selfies submitted during onboarding.
• Account statements with IBANs, account status, opening dates and wallet reference numbers.
• Withdrawal records and complete transaction histories, including Bitcoin activity.

Revolut said the derived biometric face template was not shared, only the original selfie image. Login credentials, passwords, private keys and full payment card details were not part of the disclosure.

Why did the fake request pass SPF, DKIM and DMARC?

The fake request passed authentication because it was sent from the real government domain. SPF, DKIM and DMARC check whether an email truly comes from the domain it claims. They do not check whether the individual account sending it is authorized to request data.

The three controls answer different questions:

An attacker with an account inside a trusted domain, whether created without authorization or taken over, inherits that domain’s reputation. Every check passes, and the message lands as trusted mail.

What is the difference between DMARC and brand protection?

DMARC protects your own email domain from being spoofed in email. Brand protection covers the impersonation that happens outside your infrastructure: lookalike domains, fake websites, fake apps, fake social media profiles and fake support channels that use your name.

The Revolut case shows the limit of both when used alone. DMARC worked as designed, and the attacker still succeeded because the trusted identity was abused from the inside. Brand protection matters after the incident, when attackers use the news to send follow-up phishing that impersonates the affected company or the agency involved.

How can financial institutions verify government and law enforcement data requests?

Financial institutions can stop this attack pattern by verifying every high-sensitivity data request through a channel the requester did not provide. Practical steps, in order of priority:

1. Confirm each request out of band, using a contact number or portal you sourced independently, never the details in the email.
2. Keep a registry of known agency contacts and request formats, and flag any request from an address that is not on it, even inside a valid domain.
3. Require two-person review for any disclosure that includes identity documents, biometric images or full transaction histories.
4. Apply data minimization: share only the fields the legal basis requires, not the full customer file.
5. Log every disclosure and alert on unusual volume, unusual targets (for example, high net worth accounts) or unusual timing.
6. Train compliance and legal teams to treat urgency and authority in a request as risk signals, not reasons to skip checks.

Why does this matter for crypto users?

Pairing a passport image and home address with a full Bitcoin transaction history links a real-world identity to on-chain activity. For customers who buy, sell or withdraw crypto through Revolut or its Revolut X exchange, that link raises the risk of targeted phishing, extortion and physical threats against self-custody holders.

Crypto users are already a frequent phishing target. In PhishFort’s Digital Threat Intelligence Report for January to June 2026, Crypto and DeFi accounted for 14.4% of confirmed brand impersonation cases and Financial Services and Banking for 18.6% (PhishFort internal data).

What should affected Revolut customers watch for?

Affected customers should expect follow-up phishing that uses their real details to look credible. Warning signs include:

• Messages that reference your passport, address or transaction history and ask you to “verify” or “secure” your account.
• Unsolicited contact from “Revolut support”, a regulator or a government agency, by email, SMS, phone, Telegram or WhatsApp.
• Requests to move funds to a “safe” wallet or to share recovery phrases or one-time codes.
• Links to domains that look similar to revolut.com but are not the official domain.

Contact Revolut only through the official app, and treat any unexpected request for more data as suspicious, even when it knows your details.

How PhishFort helps after an impersonation incident

After incidents like this, attackers register lookalike domains and open fake support accounts to reach worried customers. PhishFort Brand Protection monitors new domain registrations, social media and app stores for impersonation of your brand and handles the takedown with registrars, hosting providers and platforms.

Frequently asked questions

Did hackers breach Revolut’s systems?

No. Revolut said its systems and customer funds were not affected. The attacker used social engineering: a fraudulent request from a real government email domain convinced Revolut to send customer data voluntarily.

Does DMARC stop impersonation attacks?

DMARC stops attackers from spoofing your exact domain in email, but it does not stop attacks sent from a legitimate domain the attacker controls or has access to. In the Revolut case, the request passed SPF, DKIM and DMARC because it came from a real government domain.

What data was exposed in the Revolut incident?

According to customer notices, the data included names, contact details, passport or driver’s license copies, onboarding selfies, IBANs, wallet references and full transaction histories including Bitcoin activity. Passwords, private keys and full card details were not shared.

How should banks verify law enforcement data requests?

Banks should confirm every sensitive request through an independently sourced contact at the requesting agency, keep a registry of known agency contacts, require two-person review for identity data and share only the minimum data required.

Sources

• Revolut statement to media on the impersonation attack, September 2026.
• Customer notices shared publicly by ZachXBT and Mark Karpelès, September 11, 2026.
• PhishFort Digital Threat Intelligence Report, January to June 2026 (PhishFort internal data).