12 September. Revolut confirmed it sent customer data to someone who should not have had it. The request came from an email on a real government website. Revolut treated it as official. The letter to those affected lists name, date of birth, address, copies of a passport or licence, a face photo, account statements, and a list of bitcoin buys and sells.

Revolut systems and customer funds are unaffected.— Revolut spokesperson, 12 September 2026, via TechCrunch

The firm says a small number of customers were hit. It will not say how many, in which country, or which agency. The email was blocked. Police and the regulator were told. Money in the accounts did not move. Passwords neither. Mark Karpelès, former Mt. Gox chief, published the letter, The Block writes. This is not a hack of Revolut’s computers. It is a fake state request, accepted.

Sources: TechCrunch, The Block. Nothing here is advice.