Revolut customers hit by second data breach in September

Revolut customers have received breach notifications for the second time in September after a third-party brokerage service was compromised through social engineering. The incident exposed historic personal data retained under regulatory requirements, though no financial credentials or Revolut systems were directly affected.

What happened

DriveWealth, a US-based brokerage providing execution and clearing services, confirmed unauthorized access to customer records on 4 and 5 September. Attackers used a "sophisticated social engineering campaign" to extract data from accounts previously held directly with DriveWealth, including those linked to Revolut’s former US stock trading arrangement. The exposed information includes names, email addresses, phone numbers, postal addresses, employment details, citizenship, age, gender, and partial account numbers. DriveWealth stated that passwords, payment details, and other sensitive financial data were not compromised.

Revolut confirmed that its own infrastructure remained secure, with no exposure of passwords, passcodes, card details, or identity documents. The affected records date from before Revolut migrated customers in the UK, EEA, and Australia away from DriveWealth between December 2023 and June 2025. After migration, personal details were no longer shared with the brokerage.

Why it matters

The breach highlights persistent risks in third-party data handling, even after service relationships end. DriveWealth retained customer records to comply with regulatory obligations, creating a lingering exposure vector. The stolen data—while not including financial credentials—provides ample material for phishing, identity fraud, or further social engineering attacks. Revolut customers may face targeted scams leveraging their employment history, citizenship, or former account details.

This incident follows a separate breach earlier in September, where Revolut disclosed that criminals obtained sensitive customer information—including passports, driver’s licenses, and transaction data—through fraudulent information requests. The two breaches involved distinct attack methods and datasets, underscoring the challenges fintech firms face in securing customer data across multiple touchpoints.

What to watch

Neither Revolut nor DriveWealth has disclosed the number of affected customers, leaving uncertainty about the scale of potential follow-on attacks. Professionals should monitor for:

• Increased phishing attempts targeting Revolut users, particularly those who previously traded US stocks
• Potential regulatory scrutiny of data retention practices at third-party service providers
• Evolving social engineering tactics exploiting historic account relationships

Revolut has emphasized that customer funds and investments remain secure, but the repeated breach notifications may erode user trust in the platform’s data protection measures.