Revolut Gave Away Passports and Bitcoin Histories — Without Being Hacked

On September 11 and 12, the British fintech handed an unauthorized third party passport copies, verification selfies, home addresses, and full crypto transaction histories for some of its customers. Revolut confirmed all of it in its own statement. The detail that makes the incident worth a second look is the one buried under the word "breach": there was no hack to detect. No servers were broken into, no malware planted, no passwords stolen. The firm treated a fraudulent information request as a legitimate government demand and fulfilled it on that basis, and only later realized what it had done.

That inversion — a data leak executed through the process designed to prevent leaks — is the story here. It matters less for what it did to Revolut's balance sheet tonight than for what it says about the company as it approaches one of the largest fintech listings ever planned. For a U.S. retail investor, the useful question is not whether this is a sensational headline but whether it changes how you should weigh a company you cannot yet buy directly.

The exhibit: a request fulfilled, not a breach detected

Start with what Revolut says it disclosed. According to the customer notices circulated by the on-chain investigator ZachXBT, the material handed over included full names, dates of birth, occupations, home addresses, email addresses, phone numbers, copies of passports or driver's licenses, verification selfies taken at onboarding, account statements, IBANs, and full Bitcoin transaction histories.

The exclusions are just as precise. Passwords, card PINs, crypto private keys, and the biometric templates behind facial recognition were not exposed. Revolut states that its systems and customer funds were unaffected, and no customers report money missing. The perimeter held. What leaked was the dossier about who the affected users are and what they hold — the documentary evidence of identity and wealth, not the keys to either.

Revolut has not published the number of affected customers, describing it only as a "limited" group and not naming the market or the government agency involved, citing an ongoing investigation. ZachXBT assessed the targets as a small circle of wealthy users. Treat that as a characterization by an investigator, not a finding.

Why the check passed

The exploit ran through an "Emergency Data Request" mechanism — the channel that lets law enforcement obtain user information quickly in urgent situations. The unauthorized party took over or gained access to an email account inside a legitimate government agency's domain, then submitted requests that looked exactly like the real thing.

Here is the part that should give anyone pause. The request originated from a genuine agency email address on an authentic domain and passed every authentication filter Revolut applies — the technical checks such as SPF, DKIM, and DMARC that verify a domain is real. What those checks do not verify is that the specific person sending a given email is authorized to make an emergency disclosure. Domain authenticity and human authorization are different facts. Revolut's verification appears to have run on the first and assumed the second. Once authenticated, the sender stopped being an unknown email address and became a legally privileged counterparty entitled to ask for passports, selfies, and every Bitcoin the customer had ever moved.

Rename the parties and the shape is familiar. Before the email, the requester was a stranger with a text file. After it passed authentication, the requester held the identity of a government and the disclosure followed as a matter of routine. The incident is a failure of that before/after check — the moment where the requester's legal identity was granted on the basis of where the email came from rather than who was entitled to send it. Revolut blocked the address, alerted the real agency, law enforcement, data-protection authorities, and financial regulators. The damage to privacy, once done, is not undone by any of it.

The balance sheet is fine; the ledger of trust is not

For investors, start with what this incident is not worth fretting over financially. Funds were unaffected, and the exposed population appears small and wealthy — the opposite of the mass event that moves a loss reserve. Directly, this is close to a nonevent for net income.

The material cost is elsewhere. Revolut is private and carries no ticker; get the exposure question right before the valuation one. In the secondary market as of mid-2026 it was marked near a $64 billion market cap, roughly 11x revenue — a 94% markup over its last primary round. It operates as a bank in more than 30 countries with over 80 million customers, and management has told investors it is aiming for a valuation of up to $200 billion in a listing, with the CEO suggesting a debut no earlier than 2028. For an ordinary retail account in the U.S., there is no straightforward way to buy it today; the practical exposure is through funds that hold private Revolut shares — such as Fidelity, T. Rowe Price, and ARK Invest — or through the eventual public offering itself.

Which is precisely why this incident belongs in your IPO file rather than in the round file. A listing at that scale is a trust-and-permissioning event. Banks do not merely hold money; they hold the documentary evidence of who their customers are, and regulators as well as prospective investors underwrite the quality of that custody. Revolut's data-governance record is now a pattern, not a one-off. In 2022, a breach exposed personal information of 50,150 users and drew an investigation by Lithuania's data-protection watchdog. In late July 2026, threat actors claimed to be selling a database of over 75 million records; Revolut strongly denied any new compromise. Now this. Each episode is small on its own; the file is not.

The honest reading of all three: none produced a loss to customers, and none on its own is disqualifying for a company that has genuinely grown into a sprawling, bank-regulated, 80-million-user franchise. But the newest incident is the one that should sharpen the question you ask at the IPO. It shows that the failure mode is not an unbreakable wall being cracked, but an internal process handing the data over on a forged credential that looked official. That is a governance problem in the verification layer — exactly the layer a bank's charter, and an IPO prospectus's risk section, is supposed to keep tight.

The break condition

Here is the fact that, if it appears, revises this whole read. The incident stays a footnote if the affected count ends up genuinely small, if no fines follow, and if no regulator finds that the emergency-disclosure procedure was systemically lax. That is the current, reported state, and on it the sensible move is to file this as modest diligence — a data point that raises the price you would demand of management at the IPO, not a reason to panic about money you do not have at risk.

The read changes if a regulator concludes the confusion was not one bad request but a procedure that could not tell real from forged authorization — or if the affected population turns out to be larger than the "small circle" the early analysis suggested. Then the incident stops being a footnote in the IPO file and becomes the first page of it. Revolut did not get hacked this week. It gave the records away on a check that was designed to be hard and turned out to be easy. The price of that trust is only now beginning to be quoted.