Revolut Data Breach: Am I Affected and What To Do?

If you hold an account with Revolut and want to know whether the data incident of 11 and 12 September 2026 affects you, there are exactly two reliable routes: the notification the company sent to affected customers, and a subject access request of your own under Article 15 of the General Data Protection Regulation. Everything else is guesswork. Having received no message is not an all-clear; all it establishes is that no notification arrived.

This case differs from the breaches that usually occupy the industry. No server was broken into, no malware was planted and no password was cracked. An unauthorised party asked Revolut for customer data, and the request came in over the genuine, correctly authenticated email domain of a government agency. Revolut treated it as lawful and handed the documents over. For holders of Bitcoin that is particularly awkward, because the material released includes the complete transaction history.

What Revolut handed over, and what the company says remained untouched

The data categories come from CoinDesk's reporting of 12 September 2026, which draws on the notifications sent to those affected. They name passports and driving licences, the selfies from identity verification, names, dates of birth, occupations, home addresses, email addresses, phone numbers, IBANs, account statements, withdrawal logs and the entire transaction history including all Bitcoin activity.