The compromised data came through DriveWealth, the U.S. infrastructure provider through which Revolut clients traded American stocks. DriveWealth said its systems were breached between Sept. 4 and Sept. 5.
Hackers obtained client names, email addresses, phone numbers, mailing addresses, employment details, country of citizenship, age and gender, along with part of the DriveWealth account number, according to the letter the bank sent to customers, which was reported by Mediazona.
Passwords and bank card and account data were not affected by the breach, the company said.
Revolut said brokerage accounts were opened for clients directly at DriveWealth, while the bank itself only provided trading services. Users agree at registration to the transfer of personal data to both companies. The bank said the leak could only affect information DriveWealth received before December 2023, after which Revolut moved clients in the European Economic Area to a different servicing arrangement.
The incident is the second involving Revolut client data in September. The bank said earlier that it had itself handed information on some users to attackers after mistaking a forged request from government agencies for a genuine one. A company representative said the letter arrived from a real government address and passed an initial check, after which Revolut handed over the requested data. The bank later learned from officials that no such request had been sent.
According to TechCrunch, dates of birth, mailing and email addresses, phone numbers and copies of identity documents, including passports and driver's licenses, may have been exposed in that attack. The Block and Decrypt also reported data on banking and cryptocurrency transactions, including IBANs and withdrawal histories.
Citing the Financial Times, hackers demanded a $3 million ransom from Revolut, threatening to sell the client information they had obtained. The message with their terms was published on one website; the attackers did not contact the bank directly. The company has not disclosed the number of users affected.