A SECOND DATA breach involving Revolut customers has been confirmed by the fintech company.

This incident is separate to an earlier incident this month, when Revolut shared a number of its customers’ sensitive information with an unauthorised third party after it was duped by requests originating from a legitimate government agency email domain.

This incident pertains to US broker DriveWealth, which provides US stock trading services for Revolut customers.

DriveWealth provides execution and clearing services for Revolut customers who use the optional US stock trading feature. They hold customer information in order to carry out and settle those trades and for US regulatory compliance.

An unauthorised party accessed Revolut customer data held on its systems, a spokesperson for the UK company said.

DriveWealth has directly contacted those impacted. One such email, seen by The Journal, says that historic personal data involved in the security incident may include customer profile data, such as your name, email address, phone number, postal addresses, and employment information.

It may also include data such as your country of citizenship, age and gender, as well as your partial DriveWealth account number.

Alamy Stock Photo Alamy Stock Photo

“Revolut’s systems and infrastructure were not accessed or compromised, and customer funds and investments are safe. No Revolut passwords, passcodes, card details, or ID documents were exposed,” the Revolut spokesperson added.

For customers in the US, the incident relates to those who have used US stock trading.

In the UK, EEA (including Ireland), and Australia, it relates to historical records dating from before Revolut changed its stock trading model.

These changes were implemented between December 2023 and June 2025, depending on the market, Revolut explained.

Customers in the EEA were the first to be subject to the changes and have not had their data shared since December 2023.

Since these changes, customers’ personal details in these markets have not been shared with DriveWealth, meaning they are not affected.

“DriveWealth has contacted affected customers directly, and we have followed up with our own email to explain what it means for them. If you haven’t received an email, you are not affected,” the spokesperson concluded.