Revolut said it would cover the cost of replacing identity documents for customers affected by its recent data breach if replacement becomes necessary. Béatrice Cossa-Dumurgier, the digital bank’s chief executive for Western Europe, made the commitment in an interview with BFM Business. She said Revolut had provided assistance to all 680 affected clients, including 55 in France. The company did not disclose an expected cost or say whether any customers had already replaced documents.
The incident began when hackers controlled an unused email address linked to an Italian government agency and used it to request customer information. Revolut sent personal data in response to what appeared to be an official request. The company has said its internal systems were not compromised. The breach was disclosed in September and was reported to affect customers across Europe.
CUSTOMER SUPPORT MOVED TO DOCUMENT REPLACEMENT
The reimbursement commitment adds a defined form of remediation to the assistance already offered to affected customers. It is conditional on customers needing to replace their identity documents, and Revolut did not set out an application process. That leaves the eventual cost dependent on how many customers are advised to obtain replacements.
Cossa-Dumurgier also said Revolut had not paid a ransom and would not do so. The company had previously said it had not received a ransom demand. Its position separates the customer-support commitment from any payment to the people responsible for obtaining the data.
VERIFICATION CONTROLS REMAIN UNDER SCRUTINY
Italy’s interior minister, Matteo Piantedosi, told lawmakers on 30 September that the compromised address came from the Reggio Calabria police email system but had never previously been used. He said Revolut should have verified the request through basic due diligence. A Revolut spokesperson declined to comment to Reuters on the minister’s criticism.
The new commitment reduces a potential direct cost for affected customers but does not resolve questions about how official data requests were authenticated. The next practical milestones are whether customers are required to replace documents and whether regulators or investigators publish findings on the control failure. Until then, the scale of reimbursement and any wider supervisory consequences remain unknown.