Incident analysis · October 14, 2026
Revolut: 680 KYC files handed over on a forged government request
Nobody broke into Revolut's systems. The data was requested, and the request was fulfilled. This is an analysis of public reporting, not a Syntex customer story.
- Customers affected
- 680
- Attack vector
- Forged legal request
- Systems breached
- None
- Disclosed
- September 2026
What happened
According to Revolut's notice to customers and subsequent reporting, an attacker sent requests for customer information from a legitimate government agency email domain. Italy's government later told parliament that a certified email address tied to a local Interior Ministry office had been compromised, and that Revolut had provided the data of 680 customers. Because the messages carried valid domain authentication, Revolut said they were fulfilled under the reasonable belief that they were authentic government requests.
Why the request worked
Lawful data requests are an access path every regulated institution has to honour. The request looked real because it came from a real government domain. Better request verification helps, but any path that can reach a customer file will eventually be used by someone who should not have it. The question that decides the damage is what the file contains.
What a document KYC file held
- Names, dates of birth, addresses, phone numbers
- Copies of passports or driving licences
- Verification selfies
- IBANs, account statements, transaction histories
What a credentials-native file holds
- The attributes the platform requested, such as name and date of birth
- The issuer's signature over those attributes
- A record of when and how they were verified
No passport scan. No selfie.
The same request under credentials-native KYC
With credentials-native KYC, the customer presents a government credential from a wallet on their phone and approves a specific request. The institution receives only those attributes, signed by the issuer. Record-keeping obligations still apply, but they are met with the verified attributes and a description of how they were verified, not a copy of the document.
A forged request would still have reached someone. It would have found names and dates of birth, not the passport scans and selfies that make impersonation easy and stay useful for years. A leaked password can be changed. A leaked passport scan cannot.
Document KYC also multiplies the file. Every partner in a payment chain keeps its own copy, as shown on The Problem. The side-by-side with legacy KYC shows how the data trail compares at each institution.
The takeaway
You cannot lose what you were never required to keep. That is what Syntex is built on.