Revolut users, which include thousands of customers in Ireland, have experienced their second data security incident within a single month. Unlike the previous event, this breach occurred via a third-party partner rather than Revolut’s internal systems.
The security lapse took place on September 4 and 5, as confirmed by DriveWealth, the US-based broker that formerly managed US stock trading operations for Revolut clients.
What Actually Happened at DriveWealth
Rather than exploiting a software vulnerability through technical means, the attackers employed a social engineering attack to trick individuals into divulging sensitive data. DriveWealth verified that unauthorized network access was achieved using this method.
The compromised files contain solely historical customer records dating prior to Revolut’s transition to a new trading structure. For clients in the European Economic Area, which encompasses Ireland, this transition occurred in December 2023. Because Revolut ceased sharing individual user information with DriveWealth following that migration, newer users are not impacted.
The exposed records may encompass names, email addresses, phone numbers, residential addresses, employment information, and demographic details such as age, gender, and citizenship. In addition, partial DriveWealth account numbers were accessed.
Crucially, passwords, payment card details, bank account data, Revolut passcodes, and identification documents remained secure. A spokesperson for Revolut stated that DriveWealth reached out directly to those impacted, and Revolut subsequently sent out its own follow-up notifications.
Why Does This Keep Happening to Revolut Customers?
This event comes on the heels of a separate incident earlier in September, when an advanced impersonation scam leveraging a legitimate Italian government email domain deceived Revolut into disclosing confidential data. That prior event impacted roughly 680 users worldwide and compromised identity documents.
The impact of the DriveWealth breach extended past Revolut, as two additional platforms relying on DriveWealth’s infrastructure—Stake and Hatch—verified similar data exposure.
Neither Revolut nor DriveWealth has released figures specifying the total number of individuals affected. In Ireland alone, Revolut has a user base of roughly 3.4 million people.
Impacted clients are advised to keep a close eye on their communications, remain vigilant against phishing schemes, and reach out to Revolut via official support channels if they have worries. Experiencing two security breaches in a single month underscores the escalating vulnerabilities associated with third-party fintech systems.