British fintech company Revolut confirmed that sensitive customer information was disclosed to an unauthorized third party after it received fraudulent requests sent from a legitimate government agency email domain, a spokesperson for the company told Reuters.
The company is in the final stages of talks with the Bank of Israel to obtain a license to operate in the country.
“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators,” Revolut’s spokesperson said without disclosing the exact number of individuals affected by the breach, adding that “Revolut systems and customer funds are unaffected.”
The compromised data included customers’ birth dates, postal and email addresses, and phone numbers, as well as copies of their identity documents, including passports and driver’s licenses, according to a TechCrunch report.
Israeli spyware in Morocco, French targets and NSO founder’s diplomatic passport Omer Benjakob
After a lengthy period of negotiations and delays stemming from the war and other regulatory hurdles, Revolut is about to obtain a license to operate in Israel as a “light” bank and offer Israeli customers a broader range of financial services, including accepting deposits and providing credit.
About a year and a half ago, Revolut reached an agreement with Uri Natan, the former CEO of Leumi’s digital banking arm, Pepper, to appoint him CEO of its Israeli operations.
Revolut is planning for a potential public listing and aiming for a valuation of up to $200 billion. It is one of the most successful European fintech companies, with no physical bank branches.
This is not the first time Revolut has been breached. Three years ago, criminal organizations exploited a flaw in the fintech giant’s payment systems to steal more than $20 million from the company.
In that case, the thieves exploited discrepancies between Revolut’s U.S. and European systems, causing some transactions to be declined and then mistakenly refunded.