Revolut says impersonation scam exposed customer data

British digital bank Revolut said Wednesday that it shared customer information with an unauthorised third party that posed as a government agency.

Revolut said the impersonation scam used a legitimate government agency domain email to submit fraudulent requests for information. A person familiar with the matter told AFP that 680 Revolut customers across several European countries were affected.

The company said its systems and customer funds were “unaffected” and that it had contacted the limited number of impacted people directly.

An email sent to affected customers and viewed by AFP said the exposed information included addresses, verification photos, identity documents, information about banking activity and bitcoin holdings.

Britain's data protection regulator, the Information Commissioner's Office, said it had received a report about the breach and was assessing the information provided.

Italian authorities confirmed that Italian police had opened an investigation. Italy's data protection authority also asked all Italian banks to review their data access systems and report any security vulnerabilities.

The Financial Times reported that it had contacted hackers claiming responsibility for the incident. It said the hackers had exchanged emails with the bank for several months under a false identity and targeted clients holding large volumes of crypto-assets, particularly in France and Switzerland.

French entrepreneur Mark Karpeles, the former head of Mt. Gox, told AFP that he contacted police in Japan, where he lives, and checked into a hotel with his family as a precaution.

Revolut has more than 80 million customers globally and is seeking 100 million customers in 100 countries. The company secured a banking licence in Britain in March, received conditional approval for a US banking licence this month and filed for a licence application in Switzerland on Tuesday.