Béatrice Cossa-Dumurgier, Revolut’s CEO for Western Europe, said the company has been assisting affected customers and would pay if they need to replace compromised identity documents. Of the 680 customers involved, 55 are in France and eight are in Italy.
“If they ever have to change their ID documents, we’re taking care of the associated costs,” Cossa-Dumurgier said. Revolut has not disclosed how many customers have sought replacements or estimated the resulting financial cost.
The commitment follows the initial investigation into the compromised Italian government email account, through which attackers submitted information requests that Revolut treated as legitimate.
Why Is Revolut Paying to Replace Identity Documents?
The exposure included unusually sensitive information. FinanceFeeds previously reported that affected records could contain identity documents, verification selfies, addresses, IBANs, account statements, withdrawal records and cryptocurrency transaction histories.
Those categories create a different risk from a conventional password leak. Passwords can be reset and payment cards replaced, but passports, identification documents and biometric-style verification images can remain useful for impersonation and social-engineering attacks long after an incident.
That makes document replacement one of the few concrete remediation steps available to affected customers, although issuing a new document does not erase copies already obtained by attackers.
The UK Information Commissioner’s Office opened an investigation after the disclosure emerged. Revolut has maintained that its own systems and customer funds were not compromised.
Investor Takeaway
The direct expense of replacing documents for 680 customers is unlikely to be the most important financial variable. Regulatory findings and any resulting changes to Revolut’s process for handling government data requests could carry larger operational and compliance implications.
Could Revolut Have Stopped the Fraudulent Requests?
Italy’s Interior Minister Matteo Piantedosi told lawmakers on Sept. 30 that the certified email account involved was associated with the Prefecture of Reggio Calabria but had never previously been used. He argued that Revolut could and should have verified the request through basic due diligence, particularly given the nature and quantity of information requested.
The distinction is important because the incident was not a conventional intrusion into Revolut’s infrastructure. The attackers exploited a trusted communication channel and persuaded the company to release information through what appeared to be a legitimate government process.
Cossa-Dumurgier said government agencies can become the “weak link” in such situations and stressed that Revolut’s own technology systems were not breached. But the fact that the request originated from a compromised government account does not eliminate the question of whether Revolut’s internal verification controls were sufficient.
That issue has been central since FinanceFeeds first examined how fraudulent government requests bypassed Revolut’s controls. The case shows that authentic domains and technically valid emails cannot by themselves establish that a request for sensitive financial information is legitimate.
Investor Takeaway
The control weakness being tested is procedural rather than purely technological. Banks handling law-enforcement requests may need stronger secondary verification when unusually broad customer datasets are requested, even when the request arrives through an authenticated government channel.
Why Does the Incident Matter for Revolut’s Expansion?
The breach arrives while Revolut is scaling into a much larger banking institution. The company now has more than 80 million customers and was valued at $115 billion in its latest confirmed private-market transaction, making operational controls increasingly important as its customer base and regulatory footprint expand.
FinanceFeeds recently examined how Revolut’s $115 billion valuation and 80 million-user base are raising expectations around deeper banking relationships, lending and customer retention.
The Italian incident is also not the only recent data-security issue touching Revolut customers. U.S. brokerage provider DriveWealth disclosed in September that a separate social-engineering attack exposed historical information belonging to some Revolut share-trading customers. FinanceFeeds reported that the DriveWealth breach involved a separate intrusion and that there is no evidence connecting the two incidents.
Cossa-Dumurgier also said Revolut would not pay hackers. The company previously stated that it had received no direct ransom demand, even after attackers publicly claimed they wanted roughly $3 million in Monero. FinanceFeeds subsequently reported that the attackers’ stated ransom deadline expired without a confirmed payment or data sale.
Investor Takeaway
For a fintech moving deeper into regulated banking, the larger issue is whether customer growth is being matched by equally scalable compliance and verification controls. The next indicators to watch are regulatory findings, any changes to government-request procedures and whether the incident produces material customer remediation or litigation costs.
