Revolut Cyberattack Exposed Data of 50,000-Plus Customers; Lithuanian Regulator Opens Inquiry

Revolut Breach Exposed Data of More Than 50,000 Customers, Lithuanian Regulator Investigates

A cyberattack on Revolut late on Sunday 11 September 2022 exposed the personal data of more than 50,000 customers before the company identified and isolated the intrusion by early Monday 12 September, according to multiple independent reports corroborated by BleepingComputer and Which?.

The fintech, which at the time served more than 20 million customers globally — including 4.8 million in the United Kingdom, according to Which? — confirmed the incident publicly in the days that followed, describing it as a "highly targeted cyberattack."

What Was Accessed

Revolut spokesperson Michael Bodansky confirmed that "an unauthorized third party obtained access to the details of a small percentage (0.16%) of our customers for a short period of time," as reported by TechCrunch. That fraction translates to more than 50,000 individuals across Revolut's global user base.

According to TechCrunch, the exposed data included customer contact details and account data. TechCrunch's reporting specifically cited names and email addresses among the categories of personal information involved. Full payment card details and complete account numbers were not confirmed as compromised in Revolut's public statements, as reported by TechCrunch.

An unauthorised third party accessed the personal details of more than 50,000 customers in a short window before Revolut contained the breach — a reminder of how quickly targeted intrusions can move against large consumer platforms.

Revolut notified affected customers directly by email. The company stated that customers who did not receive such a notification were not impacted by the incident.

Regulatory Response

The Lithuanian State Data Protection Inspectorate, which holds supervisory jurisdiction relevant to Revolut's European operations, formally initiated an investigation into the personal data breach, according to a notice published on the regulator's own website. That investigation represents the principal confirmed regulatory action arising from the September 2022 incident documented in available sources.

Phishing Risk

Security researchers and news outlets noted that the exposure of customer contact data created conditions for downstream phishing activity. As BleepingComputer reported, the breach fuelled a new phishing wave targeting Revolut customers — a predictable consequence when contact details including email addresses are obtained by unauthorised parties and potentially exploited to craft credible-looking fraudulent communications.

Revolut customers who were not contacted by the company were told they had no cause for concern, though security practitioners generally advise vigilance for unsolicited messages following any data exposure affecting a large consumer platform.

What Remains Unverified

Reporting published elsewhere has referenced extortion threats and the alleged release of portions of stolen customer data by a threat actor following the breach. Those claims appear in secondary sources whose content could not be fully reviewed for this article and are therefore excluded from this report. Similarly, a ransom figure cited in some later coverage carries a high risk of conflation with a separate, unrelated incident and is not reported here. The precise technical attack vector — including any social-engineering or email-based method used to gain initial access — was referenced in source headlines but could not be independently confirmed from fully readable primary material and is likewise omitted.

Why It Matters

The September 2022 incident remains a significant data-security episode in the European fintech sector for several reasons grounded in the confirmed facts. A customer base of more than 20 million people means that even a breach affecting 0.16% of users translates to a substantial absolute number of individuals whose personal contact and account information was exposed, however briefly. Formal regulatory scrutiny from a national data protection authority adds legal consequence to the reputational dimension. And the documented emergence of phishing activity in the breach's aftermath illustrates how data exposures in the payments and digital-banking sector carry secondary risks that extend well beyond the initial intrusion window.

This article is based on verified facts drawn from primary regulatory sources, TechCrunch, BleepingComputer and Which?. Claims that could not be corroborated from fully reviewed sources have been omitted.