The request came from a real government domain

Financial institutions receive law enforcement requests for customer data constantly, and they are processed by people working to a service level. The check that makes the system work is that the request came from a government address.

Revolut has confirmed that somebody else was sending from one. The company described a sophisticated external impersonation scam in which an unauthorised third party used a legitimate government agency domain email to submit fraudulent requests for information.

The phrase doing the damage is legitimate government agency domain. This was not a spoofed address that authentication would catch; the mail came from the real domain, which means every technical control designed to answer the question passed it.

What the requests obtained is the reason this is more serious than most breaches of comparable size. According to the notification sent to affected customers, the exposed data includes dates of birth, home and email addresses, phone numbers, scanned passports and driving licences, verification selfies, account statements and transaction histories.

That is an identity kit rather than a contact list. A scanned passport paired with a verification selfie is precisely the bundle used to open accounts elsewhere, and it cannot be reissued the way a card number can.

The targeting appears deliberate. The investigator ZachXBT, who published the customer notification, noted that the breach appeared to be aimed at high-net-worth account holders, and the attackers have released samples from named individuals and threatened more unless they are paid. Those names are in the public reporting and are not repeated here.

Revolut, which serves more than 80 million customers across more than thirty countries, says a limited number of accounts were affected and that it has contacted them directly. It told reporters its systems and customer funds are unaffected.

Both of those statements can be true and neither addresses the exposure. No system was breached because none had to be; the data was handed over through a process working as designed, to a requester the process was not equipped to doubt.

The company says it blocked the fraudulent address on detection and escalated to the impersonated agency, to law enforcement and to financial regulators. It has not named the agency or said whether the scam was confined to one country.

That second omission is the one other institutions should press on. An attacker with access to a government mail domain does not send to one bank, and every firm that honoured a request from that domain in the relevant window has the same problem and may not know it.

The control that answers this is unglamorous and known: out-of-band verification of every data request through a channel the requester did not choose. It is slower, it irritates genuine investigators, and it is the only thing that would have failed this attack.