REVOLUT LTD
bd_a3eff37f2983ea8d · schema v1 · pii pii-v2
Full breach record for REVOLUT LTD →Press / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage and machine-translated to English — verify against the source.
Summary
machine-translatedRevolut confirms it sent passport and Bitcoin data to a fake government address. Revolut: Revolut has confirmed it was the victim of a sophisticated spoofing cyberattack in which fraudsters obtained customer data, including passports, verification selfies, driver's licenses, addresses, and Bitcoin transaction records. The attack used an email from a government agency's official domain. Revolut assured that customer systems and funds are not affected, and that login codes and biometric data were not exposed. The company has alerted the relevant authorities and is under investigation.
P pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Sep 12, 2026
Press report
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
If an SEC 8-K, state-AG notice or victim statement lands, DisclosureLens merges it into an incident and links it here.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.