Revolut hit by second customer data breach in a month

Revolut confirmed that unauthorized access affected a subset of customer account and personal information, marking the company’s second security incident in less than four weeks.

The company detected unusual activity on parts of its systems and opened an internal investigation. Revolut notified customers it believes were affected and reported the incident to relevant data protection authorities and law enforcement while engaging external cybersecurity specialists to contain the issue.

Revolut said the access was limited to a portion of stored customer records rather than a full compromise of its platform. The firm has not published a comprehensive list of the specific types of data exposed and is contacting impacted customers directly with guidance on next steps.

The security team is examining how the intruders gained entry and whether the same vulnerability was exploited in both recent incidents. Revolut is implementing additional controls and increasing monitoring for suspicious activity as investigators work to determine the scope and origin of the breach.

Customers identified as potentially affected were advised to review recent account activity, change passwords and enable or confirm multi-factor authentication settings. The company updated its customer support channels and online resources with information on how users can protect their accounts and report suspected fraud.

Revolut has reported the breach to data protection authorities in the markets where it operates. Those regulators have opened review processes to assess the incident and whether legal obligations on data protection and breach notification were met.

The second breach follows an earlier incident this month that also exposed customer information. Revolut stated the two cases are being investigated together to establish any technical or operational links. The company also indicated that core payment services and access to funds remain operational and are protected by existing safeguards.

As part of its response, Revolut is reviewing relationships with third-party vendors and updating internal security protocols. The firm noted it is working with external experts to strengthen defenses and to prevent further unauthorized access.

Revolut is a London-headquartered financial technology company that offers banking, payments, currency exchange and other financial services to retail and business customers in multiple countries. Customers concerned about potential exposure have been urged to follow communications from Revolut, monitor bank statements and report any suspicious transactions to the company and to local authorities. Revolut has pledged to provide updates to regulators and customers if the scope of the breach changes.