According to CoinMeta, Revolut disclosed some customers' personal and financial information during a data incident due to mistakenly treating a fraudulent government information request as legitimate, exposing weaknesses in the authentication methods for legitimate data requests when the requesting agency's own email infrastructure was compromised. This incident differs from traditional phishing attacks in that the malicious requests did not come from a single, similar email address. According to excerpts from the security notifications sent to affected customers, the requests originated from an unauthorized email account created within the infrastructure of an official government agency and carried genuine domain name authentication credentials. Revolut stated that the request was fulfilled on the assumption that it came from a legitimate government agency. Subsequently, the company contacted the agency for verification and concluded that the email address was unauthorized. Revolut subsequently blocked this address within its internal systems and notified the relevant regulatory authorities. The potential scope of exposure in this incident goes beyond basic account information; it may have included customers' names, addresses, and historical records of identification documents related to Bitcoin transactions or identifiable wallet activities, which could enable attackers to construct more detailed profiles.