DriveWealth Blames Social Engineering Campaign for Revolut…

Revolut customers have been caught up in a fresh security incident after U.S. brokerage infrastructure provider DriveWealth confirmed that unauthorized parties accessed its network over a two-day period in September. DriveWealth described the intrusion as the result of a "sophisticated social engineering campaign." The exposed records belong to some users of Revolut's U.S. share-trading service.

The compromised data may include customer names, email addresses, postal addresses, telephone numbers and employment information. DriveWealth said it has no current reason to believe that passwords or financial payment details, including credit card and bank account information, were involved. Revolut told affected customers it is in direct communication with the DriveWealth team to pin down the exact scope of the incident, and stressed that the breach did not involve an intrusion into its own systems.

For European customers, the affected information relates to historical records created before Revolut restructured its U.S. stock-trading service. Those changes were rolled out between December 2023 and June 2025 depending on the market, after which individual customer details in those jurisdictions were no longer shared with DriveWealth.

Why historical records still matter

The age of the data limits some immediate risks, but it does not make the information harmless. Names, addresses, phone numbers, emails and employment details remain useful for phishing, impersonation and targeted social engineering long after a customer relationship or data-sharing arrangement changes. That makes this primarily a data-security matter rather than a threat to customer balances. Revolut says no passwords or payment credentials were exposed, and there is no indication that investments or funds were accessed. The episode also highlights the exposure created by fintech partnerships: DriveWealth supplies brokerage infrastructure that lets consumer platforms offer investment products without building every part of the securities operation themselves.

The DriveWealth incident is separate from a customer-data exposure Revolut disclosed earlier this month. In that case, fraudulent information requests sent from a legitimate government agency email domain led Revolut staff to release sensitive customer records to an unauthorized party. That earlier incident involved identity documents such as passports and driving licences, plus contact and account information; later reporting put the number of affected customers at 680 and prompted an investigation by the UK's Information Commissioner's Office. Hackers claiming responsibility demanded roughly $3 million in Monero and threatened to sell the data, though the deadline expired with no independently confirmed sale. There is no evidence the two episodes are connected, and the attack methods differ.

Two customer-data incidents surfacing within weeks of each other create a reputational test even where Revolut itself was not technically breached in the latest case. Customers generally experience a financial platform as a single service, even when brokerage, custody and payments are delivered by outside providers. The immediate question is not whether funds are at risk, but whether Revolut and its partners can establish exactly which historical records were accessed, notify everyone affected and show that two separate September security events do not point to a wider weakness across the partner network.