DriveWealth has disclosed a data breach affecting some former customers, including Revolut users, after attackers used social engineering to gain unauthorised access on 4 and 5 September. The incident matters because the stolen historical information could support phishing, impersonation, identity fraud and further social engineering, although Revolut’s systems, funds and investments were not compromised.

The exposed records may include names, contact and postal details, employment information, citizenship, age, gender and partial DriveWealth account numbers. Passwords, payment details, identity documents and other sensitive Revolut credentials were not affected, but neither company has said how many Revolut customers were involved; the breach follows a separate September incident in which criminals obtained customer information through fraudulent government-style requests.