Revolut's Double Data Breach: What Firms Need to Know

Two data breaches at Revolut in the space of two days have placed customer identity data, including names, addresses, citizenship details, and employment information, in the hands of threat actors who are now attempting to monetise it. For accounting firms, auditors, and CFOs that rely on digital-asset platforms for client onboarding and transaction monitoring, the incidents are a direct prompt to audit third-party vendor risk, KYC data pipelines, and AML escalation procedures. The primary keyword here for practitioners is straightforward: robust crypto accounting software workflows are only as trustworthy as the data flowing into them, and that data starts with the identity layer.

What Happened: Two Breaches, Different Attack Vectors

The DriveWealth Social Engineering Attack

On 4 and 5 September 2026, Revolut's former US brokerage partner DriveWealth was compromised through a social engineering attack. Both companies disclosed the breach on the same day. The categories of data exposed are broad: full names, email addresses, ages, genders, citizenship information, postal addresses, and employment details. Neither Revolut nor DriveWealth disclosed the number of affected users, and no specific detail about the method of social engineering was made public beyond the classification of the attack type.

Revolut confirmed that the breach does not include data from European Economic Area customers beyond 2023, which limits EU GDPR exposure to a historical window but does not eliminate it. EEA customers whose data pre-dates the 2023 cut-off could still be affected, and the absence of a precise headcount makes individual risk assessment difficult for any firm whose clients hold Revolut accounts.

The Italian Government Email Incident

Separately, earlier in September 2026, Revolut disclosed that an attacker used an Italian government email address to gain unauthorised access to company data. That incident appears distinct from the DriveWealth breach. The two disclosures arriving within weeks of each other, each involving different attack methods, signal a pattern of coordinated or opportunistic targeting rather than an isolated event.

Ransom Demands, Published Data, and the "Italy Files"

Escalating and Contradictory Demands

Following the Italian email incident, ransom demands reportedly ranged from $760 million in Bitcoin down to $3 million in Monero within a matter of days, a wild swing that itself suggests the threat actors lacked a coherent monetisation strategy. The hacker subsequently acknowledged that negotiations did not go as planned.

The 680 Crypto Whale Dataset

The attackers then published what they called the "Italy Files," a dataset said to contain personal information belonging to 680 high-value crypto account holders, publicly identified as "crypto whales." One named individual in reporting is Mark Karpelès, the former CEO of Mt. Gox. The hacker has since reportedly offered affected individuals the option to pay to suppress their own data from further publication, a secondary extortion tactic.

Financial journalist Jason Mikula noted that the data is now being sold at roughly one-tenth of the original ransom price, which he interpreted as evidence that the group is struggling to convert the stolen data into revenue. That context matters for risk assessment: data that cannot be profitably sold in bulk may instead be used in targeted spear-phishing, account takeover, or identity-theft campaigns against specific high-value individuals, a threat profile that is highly relevant to any firm advising clients with significant digital-asset holdings.

The Vendor Risk Problem This Exposes

Third-Party Brokers as a Weak Link

The DriveWealth breach illustrates a structural vulnerability that accounting and compliance teams often underweight. When a regulated fintech like Revolut outsources brokerage execution to a third party, KYC data collected at onboarding travels with the relationship. If the third party's security controls are weaker, the collected identity data is only as protected as the weakest point in the chain. Social engineering, the attack vector here, targets people rather than technology, which makes it particularly difficult to defend against through technical controls alone.

For firms that use crypto bookkeeping software or integrated platforms that pull client identity data from exchanges and fintech APIs, this is a material reminder that data provenance matters. If a client's KYC record was sourced from or validated against a platform now known to have suffered a breach, the integrity of that record should be re-examined.

Assessing Exposure Across Your Client Base

The practical first question for any firm is whether any of its clients are Revolut users, DriveWealth account holders, or both. Given Revolut's scale across the UK and EU, and DriveWealth's reach in US brokerage, the overlap with a typical digital-asset client base is likely non-trivial. Firms should:

• Identify clients who have disclosed Revolut or DriveWealth relationships during onboarding or in transaction records.
• Flag those clients for potential enhanced due diligence under existing AML policies, particularly where the client holds significant crypto positions.
• Consider whether any KYC documentation sourced from or cross-referenced against these platforms needs re-verification.

Understanding how AML behavioral detection flags suspect wallets is increasingly relevant here: if breached identity data is used to open new accounts or layer funds, transaction monitoring tools should be tuned to catch the resulting anomalies. Read more on how AML behavioral detection flags suspect wallets in the context of blockchain-based monitoring.

Regulatory Obligations Triggered by a Breach of This Type

UK and EU: GDPR and FCA Expectations

Under the UK GDPR and EU GDPR, a personal data breach must be notified to the relevant supervisory authority within 72 hours of the controller becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of individuals. The categories of data reported here, citizenship, employment, and address information, are precisely the types that regulators consider capable of causing real-world harm.

Revolut is regulated by the Financial Conduct Authority in the UK and holds an e-money licence in multiple EU jurisdictions. The FCA's expectations around operational resilience, particularly third-party risk, are set out in its Policy Statement PS21/3 and related supervisory guidance. Accounting firms advising UK-regulated clients on compliance frameworks should be aware that the FCA may scrutinise Revolut's third-party oversight arrangements in any subsequent supervisory review.

US: State Breach Notification Laws and FinCEN Considerations

In the US, DriveWealth as a regulated broker-dealer operates under FINRA oversight, and the breach likely triggers notification obligations under applicable state data-breach laws. Depending on the volume and residency of affected customers, notification to multiple state attorneys general may be required. For US-based accounting firms with clients using DriveWealth's platform, the question of whether Suspicious Activity Report obligations are triggered, if the breach is assessed as facilitating potential financial crime, is worth raising with AML counsel.

The broader enforcement landscape is relevant context. As covered in our earlier analysis of what the Binance Iran sanctions probe means for compliance teams, regulators are increasingly holding crypto-adjacent firms to the same standards as traditional financial institutions when it comes to third-party oversight and data integrity.

Accounting and Operational Implications

Digital Asset Accounting Software and Data Integrity

Practitioners using digital asset accounting software to reconcile client portfolios depend on accurate identity attribution to transactions. When a breach compromises identity records, two downstream risks emerge. First, if compromised credentials are used to access client accounts and move funds, the resulting transactions may appear legitimate in a ledger but represent misappropriation. Second, if an attacker uses breached identity data to impersonate a client in communications with their accountant or custodian, the firm may act on fraudulent instructions.

Both scenarios require firms to strengthen out-of-band verification for any material transaction instruction received from clients who may be affected. A policy of confirming large or unusual instructions through a secondary channel, a direct phone call to a known number, for example, is a basic but effective control.

Financial Statement and Audit Considerations

For audit teams, a data breach at a platform used by a client introduces a going-concern and internal-control consideration. If the client entity itself uses Revolut for treasury or payroll operations, auditors should enquire whether any unauthorised transactions occurred, whether the client has notified its own insurer, and whether cyber liability coverage extends to third-party breach scenarios. These are not hypothetical concerns; the published nature of the "Italy Files" means threat actors have a ready target list.

CFOs managing digital-asset treasury positions should also review whether their custody arrangements sit with platforms that share KYC data with third-party brokers without explicit data processing agreements, and whether those agreements include breach notification timelines that align with regulatory requirements.

Practical Steps for Firms This Week

Immediate Actions

The following steps are proportionate to the information currently available:

• Run a client-base review to identify any disclosed relationships with Revolut or DriveWealth.
• Issue a targeted communication to affected clients advising them to change passwords, enable multi-factor authentication across all financial accounts, and be alert to phishing attempts using the categories of data known to be exposed.
• Review vendor due-diligence questionnaires for all third-party data processors integrated into your client onboarding or transaction monitoring workflows. Where a broker or exchange shares KYC data with sub-processors, confirm that sub-processor security standards meet or exceed your own.
• Document your firm's assessment of the breach and any steps taken, to demonstrate compliance with your own data protection obligations if a client raises a complaint or if a regulator enquires.

Longer-Term Policy Review

This incident is a useful trigger for a broader review of third-party risk within crypto-adjacent service delivery. Questions worth asking include: which platforms have access to your clients' identity data, what contractual protections govern that access, and how quickly would you know if a breach occurred at one of those platforms? A structured third-party risk register, updated at least annually, is the minimum expected standard under FCA operational resilience rules and is increasingly cited in EU DORA guidance as well.

Source: Protos

Frequently Asked Questions

Does the Revolut breach affect EEA customers?

Revolut confirmed that the DriveWealth breach does not include EEA customer data beyond 2023. However, EEA customers whose data predates that cut-off may still be affected, and the separate Italian email incident appears to have its own scope that has not been fully disclosed.

What data categories were exposed in the DriveWealth breach?

The confirmed categories include names, email addresses, ages, genders, citizenship information, postal addresses, and employment details. Neither Revolut nor DriveWealth disclosed the total number of affected individuals.

What should accounting firms do if a client is a Revolut user?

Flag the client for a KYC re-verification review, advise them to secure their accounts, and assess whether the relationship warrants enhanced due diligence under your AML policy. Document all steps taken in your compliance file.

Are there SAR obligations arising from this breach for US firms?

That depends on whether the breach is assessed as facilitating or likely to facilitate financial crime. Firms should consult AML counsel, particularly if there is evidence that breached data is being used to access client accounts or conduct fraudulent transactions.

How does this incident relate to crypto accounting software workflows?

Any workflow that ingests client identity data from third-party platforms, whether for onboarding, transaction attribution, or reporting, is only as reliable as the integrity of that data. A breach affecting identity records at a source platform should prompt a review of whether any records in your system were sourced from or validated against the affected platform.