Revolut Customers in Ireland Affected by DriveWealth Data Breach Exposing Historical Account Details

Revolut Customers in Ireland Affected by DriveWealth Data Breach Exposing Historical Account Details

Revolut customers in Ireland have been affected by a data breach at DriveWealth, a US-based broker that previously managed US stock trading for the Dublin-headquartered fintech company. The breach, which occurred between September 4 and 5 as a result of a social engineering attack on DriveWealth's systems, exposed historical customer profile information including names, email addresses, phone numbers, postal addresses, and employment details for customers who used Revolut's US stock trading feature before December 2023. Revolut has confirmed that its own systems, customer funds, and investment accounts were not compromised.

Background

Revolut, which is headquartered in Dublin and holds a banking licence in Lithuania that allows it to operate across the European Union, has grown into one of the largest fintech companies in the world, with over 50 million customers globally and a significant presence in the Irish market. The company offers a range of financial services, including current accounts, currency exchange, cryptocurrency trading, and stock trading, and has been expanding its product range aggressively in recent years as it seeks to compete with traditional banks.

The US stock trading feature, which allowed Revolut customers to buy and sell shares in US-listed companies, was previously managed through a partnership with DriveWealth, a New Jersey-based broker-dealer. Revolut changed its US stock trading model between December 2023 and June 2025, moving away from the DriveWealth partnership, which means that the data exposed in the breach relates to historical records from before that transition. Customers who joined Revolut or began using the US stock trading feature after December 2023 are not affected by the DriveWealth breach.

The breach is the second data security incident affecting Revolut customers to come to light in September 2026. Earlier in the month, Revolut disclosed that a social engineering attack using a government agency email domain had exposed the personal data of approximately 680 customers globally, including 12 individuals in Ireland. The two incidents are unrelated, but their proximity has raised questions about the adequacy of data security practices at Revolut and its third-party partners.

Key Developments

The DriveWealth breach occurred when attackers used social engineering techniques to gain access to DriveWealth's systems on September 4 and 5. The compromised data includes names, email addresses, phone numbers, postal addresses, employment information, biographical data including age, gender, and country of citizenship, and partial DriveWealth account numbers. Revolut has confirmed that no passwords, passcodes, or payment card details were exposed, and that customer funds and investment accounts remain secure.

Revolut has contacted affected customers directly to inform them of the breach and to advise them on steps they can take to protect themselves, including being vigilant for phishing attempts and unsolicited communications that may use the exposed data to appear legitimate. The company has also reported the incident to the relevant data protection, financial, and law enforcement authorities, including the Data Protection Commission in Ireland, which is Revolut's lead supervisory authority under the GDPR for its EU operations.

The Data Protection Commission, which fined Google €403 million for GDPR violations earlier this week, has confirmed that it has received Revolut's breach notification and is assessing the circumstances of the incident. Under the GDPR, companies are required to notify their lead supervisory authority of a personal data breach within 72 hours of becoming aware of it, and to notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

Why It Matters

The DriveWealth breach is a reminder that the data security risks associated with fintech services extend beyond the primary service provider to encompass the entire ecosystem of third-party partners and suppliers on which those services depend. Revolut's own systems were not compromised, but the exposure of customer data held by a former partner illustrates the difficulty of maintaining control over personal data once it has been shared with third parties. The GDPR's accountability principle requires companies to ensure that their data processors — including third-party partners — apply appropriate security measures, and the DriveWealth incident will raise questions about the adequacy of the contractual and technical safeguards that Revolut had in place with its former partner.

For Irish customers, the breach is a reminder that the personal data they share with fintech companies may be held by a range of third parties in different jurisdictions, each with its own security practices and regulatory environment. DriveWealth is regulated in the United States by the Financial Industry Regulatory Authority, and the breach will be subject to investigation by US as well as Irish and EU authorities. The cross-border nature of the incident illustrates the complexity of enforcing data protection standards in a global fintech ecosystem.

Local Impact

In Ireland, Revolut has a large and growing customer base, with the company reporting that it has over 2.5 million customers in the Republic. The affected customers — those who used the US stock trading feature before December 2023 — represent a subset of that total, but the breach will nonetheless cause concern among a significant number of Irish users. The Data Protection Commission's investigation will be closely watched by the fintech industry, as any enforcement action against Revolut could set a precedent for how the commission approaches data security failures involving third-party partners. The commission has been increasingly active in enforcing the GDPR against major technology companies, and the Google fine announced this week demonstrates its willingness to impose substantial penalties for serious violations.

What's Next

The Data Protection Commission's assessment of the DriveWealth breach is expected to take several months, with a formal investigation likely to be opened if the commission concludes that Revolut's data protection practices were inadequate. Revolut has indicated that it will cooperate fully with the commission's inquiry and with any parallel investigations by US authorities. Affected customers who have concerns about the use of their data should contact Revolut's data protection team directly and should be vigilant for phishing attempts in the coming weeks. The company has also indicated that it will provide regular updates to affected customers as the investigation progresses. The broader question of how fintech companies manage data security across their third-party ecosystems is expected to feature in the European Commission's forthcoming review of the Digital Operational Resilience Act, which sets out requirements for financial sector entities to manage ICT risks.