DriveWealth Breach Exposes Personal Data of Revolut and Other Brokerage Customers A security breach at DriveWealth, the U.S.-based brokerage powering Revolut’s stock trading services, compromised the personal data of some Revolut customers and users of other brokerage platforms. The incident, disclosed via emails to affected individuals on Thursday, 19 September, stemmed from a social engineering attack that granted unauthorized access to DriveWealth’s network on 4–5 September. ### What Was Exposed? The breach involved historic personal data held by DriveWealth, including: - Names, email addresses, phone numbers, and postal addresses - Employment details, country of citizenship, age, and gender - Partial DriveWealth account numbers Critical exclusions: Passwords, payment details (card or bank account numbers), and Revolut-specific credentials such as passcodes or ID documents were not accessed. DriveWealth confirmed no unauthorized trading, transfers, or withdrawals had occurred. ### Who Was Affected? - Revolut customers who used its U.S. stock trading service before December 2023 (EEA) or June 2025 (UK/Australia). Revolut clarified that the breach did not impact its own systems. - Other brokerage clients, including customers of Australia’s Stake (notified 21 September) and New Zealand’s Hatch (notified 22 September). For these users, exposed data also included portfolio values and cash balances. - Approximately 62,000 Rhode Island residents, per DriveWealth’s public notice. ### How Did It Happen? DriveWealth attributed the breach to a social engineering campaign by unidentified third parties. The company reported the incident to Lithuania’s data protection authority, where Revolut is headquartered. ### Broader Context This marks the second data incident for Revolut in September. On 12 September, the fintech confirmed it had inadvertently shared customer passports with scammers posing as government officials. Despite the breaches, Revolut valued at $115 billion is proceeding with plans for a dual stock market listing in London and New York.

Stake and Revolut Customers Impacted by Third-Party Data Breach at DriveWealth Trading platform Stake has disclosed a data breach affecting its customers after a cyber incident at DriveWealth, a U.S.-based third-party service provider. In an email to users, Stake confirmed that personal data including names, email addresses, phone numbers, tax status, and postal addresses was exposed. However, sensitive financial details such as tax file numbers, bank accounts, and trading portfolios remained unaffected, with no evidence of unauthorized transactions. The breach also impacted Revolut customers across the U.S., UK, EEA, and Australia, though Revolut stated its own systems and customer funds were not compromised. DriveWealth has not yet identified the threat actor responsible. This incident marks the second security lapse for Revolut in July. Earlier this month, the company mistakenly shared customer data with an unauthorized third party after receiving a fraudulent request from a spoofed government email domain. The fake request, sent on July 21, included valid domain authentication credentials, leading Revolut to fulfill it under the belief it was legitimate. Exposed data included names, birth dates, occupations, identity documents, transaction histories, and account details. Revolut later blocked the email address and notified regulators and law enforcement. Both companies have emphasized that their core systems remained secure, with no direct breaches of their own infrastructure. Investigations into the incidents are ongoing.