Revolut discloses potential leak of some users' KYC and Bitcoin transaction data, systems and funds unaffected.

BlockBeats news, September 13: Revolut disclosed that an unauthorized third party used an email address under a real domain of a government agency to submit fraudulent customer data access requests, resulting in the disclosure of sensitive information of a small number of customers. The company called the incident a "sophisticated external impersonation scam," has now blocked the relevant email address, and stated that its own systems and customer funds were not affected.

The information that may have been disclosed includes names, dates of birth, addresses, email addresses, phone numbers, copies of identity documents such as passports and driver's licenses, identity verification selfies, account statements, IBANs, withdrawal records, and full transaction history, including Bitcoin transaction records. Former Mt. Gox CEO Mark Karpelès said he was one of those affected.

Revolut did not disclose the number of affected customers, whether the incident involved only a single market, or which government agency owned the impersonated domain. The company has notified the relevant government agencies, law enforcement, data protection authorities, and financial regulators. On-chain investigator ZachXBT speculated that the scale of the incident may be limited, but the targets may have been high-net-worth users.