Revolut has confirmed that some Irish customers were affected by a data breach involving a third-party company that provides services to the digital bank related to its US stock trading feature.
The incident, the second separate issue involving the fintech this month, relates to DriveWealth, a US broker that provides US stock trading services to Revolut customers.
The breach relates to historical records dating to before December 2023. According to an email seen by The Irish Times, DriveWealth told affected customers that the information contained in the leak may include customer profile data, including names, phone numbers, postal addresses and employment information.
“Biographical data, such as your country of citizenship, age and gender”, may also have been affected.
RM Block
Revolut said its systems were not compromised and customer funds and investments are safe, as are user passwords, passcodes, card details and ID documents.
“In the US, the incident relates to customers who have used US stock trading,” a spokesman said.
“In the UK, EEA (European Economic Area) and Australia, it relates to historical records dating from before we changed our US stock trading model. We implemented these changes between December 2023 and June 2025, depending on the market. Since then, individual customers’ personal details in these markets have not been shared with DriveWealth and, as a result, are not affected.”
The spokesman said that DriveWealth was “best placed” to say how many Irish customers are affected. DriveWealth was approached for comment.
[ Hackers demand Revolut hand over $3m ransom amid data breachOpens in new window ]
Revolut said that DriveWealth has contacted affected customers directly and that Revolut has followed up with its own emails, explaining the situation and what it means for them.
In a statement on its website, DriveWealth said it discovered unauthorised access to its network had occurred between September 4th and 5th.
“This security incident involved unauthorised access to personal data contained in certain systems of DriveWealth,” it said.
Based on its own investigations, the company said it “discovered that certain personal information was exfiltrated from our network”.
DriveWealth said: “At this time, we have no reason to believe any other sensitive personal information was affected. No passwords or financial payment information (such as credit card or bank account details) were compromised.”
Earlier this month, Revolut said a “sophisticated external impersonation scam” was behind a separate data breach that involved the company releasing sensitive information about its customers.
[ Revolut’s plan: a global bank with ‘effectively zero risk’Opens in new window ]
A spokesman for the company said a “limited number” of individuals were impacted by the breach and these customers had been contacted directly.
He added that Revolut’s systems and customer funds were unaffected by the breach.
It reported that data shared with the third party as part of the breach included customers’ identity and contact details, their dates of birth, postal and email addresses and phone numbers.
