Cyber Bites - 18th September 2026

So British fintech giant Revolt has confirmed that sensitive customer data was handed over to an unauthorized third party after staff were deceived by fraudulent information requests sent from a legitimate government agency email.

domain.

The exposed data is pretty significant.

It covered customers' full identity and contact details, including birth dates, postal addresses, email addresses, phone numbers, as well as copies of identity documents such as passports and driver's licenses.

And depending on the individual customer, the breach may also have included verification selfies, account statements and transaction histories.

Revolt described the incident as a sophisticated external impersonation scam and said that it blocked the email address once the fraud was discovered.

before alerting the relevant government agency, law enforcement and applicable regulators.

The company confirmed that its own systems and customer funds would not compromise.

Now they declined to disclose how many customers were affected beyond describing that the number is limited and refused to identify the government agency whose email domain was spoofed or confirm whether the incident was contained to a specific market The company did confirm it had contacted affected customers directly.

A security researcher who first drew attention to the breach after the customer notification circulated online suggested the incident appeared to have deliberately targeted at high net worth users rather than representing a broad sweep of the customer base.

raising the possibility that the attackers had prior knowledge of which accounts were worth pursuing.

The timing is notable given the broader context surrounding Revolt.

The London based company, which serves more than 18 million customers across more than 30 countries, is reportedly weighing a public listing that could value it as much as $200 billion, which is nearly triple its $75 billion private valuation from late last year.

It has also been on an active expansion push, recently securing banking license in France and the United Kingdom, and receiving conditional approval from the US Office of the Comptroller of the Currency to establish a national bank stateside, which is expected to launch in the first half of 2027.

So British fintech giant Revolt has confirmed that sensitive customer data was handed over to an unauthorized third party after staff were deceived by fraudulent information requests sent from a legitimate government agency email.

domain.

The exposed data is pretty significant.

It covered customers' full identity and contact details, including birth dates, postal addresses, email addresses, phone numbers, as well as copies of identity documents such as passports and driver's licenses.

And depending on the individual customer, the breach may also have included verification selfies, account statements and transaction histories.

Revolt described the incident as a sophisticated external impersonation scam and said that it blocked the email address once the fraud was discovered.

before alerting the relevant government agency, law enforcement and applicable regulators.

The company confirmed that its own systems and customer funds would not compromise.

Now they declined to disclose how many customers were affected beyond describing that the number is limited and refused to identify the government agency whose email domain was spoofed or confirm whether the incident was contained to a specific market The company did confirm it had contacted affected customers directly.

A security researcher who first drew attention to the breach after the customer notification circulated online suggested the incident appeared to have deliberately targeted at high net worth users rather than representing a broad sweep of the customer base.

raising the possibility that the attackers had prior knowledge of which accounts were worth pursuing.

The timing is notable given the broader context surrounding Revolt.

The London based company, which serves more than 18 million customers across more than 30 countries, is reportedly weighing a public listing that could value it as much as $200 billion, which is nearly triple its $75 billion private valuation from late last year.

It has also been on an active expansion push, recently securing banking license in France and the United Kingdom, and receiving conditional approval from the US Office of the Comptroller of the Currency to establish a national bank stateside, which is expected to launch in the first half of 2027.