service outage

Revolut reveals customer data breached twice this month

0Importance
closedStatus
3News media
3Pieces
Published

Revolut disclosed that customer information was exposed in two incidents on September 4 and September 5 involving its former third-party US broker DriveWealth. The affected data included personal details such as names and contact information, and in some cases broader profile or investment-related information. Some Revolut customers in Ireland were among those affected, and the incident was also reported as touching customers of other platforms connected to DriveWealth.

Key claims & sources

✓
Revolut said customer data was exposed in two incidents on September 4 and September 5 involving its former third-party US broker DriveWealth.
✓
The exposed information included names, emails, ages, genders, citizenship information, postal addresses, and employment details.
✓
An unauthorised party accessed personal information and, in some cases, investment-related information on September 4 and 5.
✓
Some customers of Revolut, Stake, and Hatch were affected, and the categories of exposed information differed across the three platforms.
✓
Information tied to older customer profiles may have been exposed, including names, contact details, addresses, and employment data.
✓
Revolut customers, including thousands in Ireland, faced a second data incident this month, and DriveWealth confirmed the breach dates as September 4 and 5.

What it means

Revolut customers are the people most directly affected, along with some customers of Stake and Hatch who were also linked to the same incident. For them, the change today is that personal details and, in some cases, investment-related information were exposed rather than remaining internal to the brokerage setup.

Before these incidents, DriveWealth handled US stock trading for Revolut users; after the disclosure, customer data tied to that setup is described as having been exposed on September 4 and 5. What stays the same is that the platforms are still tied to the same third-party infrastructure relationship, even though the incident involved different categories of information across the affected services.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
— 2 h before
-0.1% 4 h after
$2.9Tmarket cap at publication
9data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 24 16:57
Protos scoop
Breaks the event: $3M
+3 min
Sep 24 17:00
Finance Magnates context
Its angle: infrastructure, notifications, disclosures; with quotes
+5 h 23 m
Sep 24 22:20
BeInCrypto echo
No new facts: unauthorized, manipulates, responsible

Other recent incidents

WhenWhat happenedFigure
2 days ago FLOKI Trading Bot incident no figure in dollars
2 days ago TENDRIL · Swap Logic Flaw incident $550k
2 days ago $TENDRIL · Smart contract vulnerability incident $555k
4 days ago InsurancePool/CoreVault · Flash loan attack incident $112.3k
5 days ago Solana MEV Bot King · Hot wallet key compromise incident $856k

4282 incidents stored