British multinational fintech company and neobank Revolut has disclosed a second data security incident this month after one of its service providers fell victim to a cyber attack, exposing sensitive customer information.
Revolut reported a second data security incident this month after service provider DriveWealth suffered a cyber attack that exposed sensitive customer information.
Revolut is a London-based digital banking platform offering services such as multi-currency accounts, global payments, savings, budgeting, and investments. DriveWealth is a US-based B2B fintech that provides Brokerage-as-a-Service, powering the trading and brokerage infrastructure behind Revolut’s US stock investment services.
In a data security incident notice published on its website, Revolut said DriveWealth had recently notified the company that an unauthorised third party had gained access to customer data stored on its systems.
While Revolut did not disclose the specific data that was compromised, it explained that customers signing up for US investment services entered into two agreements—one with the relevant Revolut trading entity and another with US-based DriveWealth. As a result, the information required to provide the trading services was shared with both companies.
“Revolut’s own systems, app infrastructure, and core databases were not accessed or affected in any way. All Revolut customer funds and investments remain completely safe.
“All affected Revolut customers have received two emails, one from DriveWealth and one from Revolut, confirming they were impacted and explaining the scope of the breach,” the fintech giant said.
In a notice detailing the incident, DriveWealth said that an unauthorised party gained access to its internal network between September 4 and September 5 and accessed personal data contained in certain systems.
The compromised data included personal identifiers, but DriveWealth confirmed that passwords and financial information, such as credit card and bank account details, were not affected.
“No unauthorised brokerage account activity including trading, transfer, withdrawal, ACAT request, or balance or position alteration was identified. Production brokerage and trading systems and the client-facing platform were not impacted by this activity and continue to operate normally,” DriveWealth said.
The brokerage company advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.
Earlier this month, Revolut reported another data security incident after threat actors impersonated a legitimate government agency using a spoofed email domain to request sensitive information from the company.
