DriveWealth's breach reached Revolut customer records up to 33 months after Revolut stopped sending them

Revolut used DriveWealth to support US stock trading for its customers ^[4]. It changed its trading model in the UK, EEA and Australia between December 2023 and June 2025, depending on the market ^[5]. The intrusion came in September 2026 ^[1]. From June 2025 to September 2026 is 15 months; from December 2023 it is 33 ^[1]. So the newest records from those markets had been on the broker's systems for at least 15 months when the network was entered, and in the first market to switch, for almost three years ^[1].

Revolut says accounts opened after the change should not be in the exposed set ^[7], so the switch capped how many customers a DriveWealth failure could reach. It did not shrink the group already on file. Neither company has published a count of affected Revolut users ^[8], and Crowdfund Insider's report does not say whether DriveWealth was required to keep the older records or whether Revolut asked for them to be deleted.

The evidence fits more than one reading, and each puts the fault in a different place. If a record-keeping duty kept those files at DriveWealth, the model change was the only lever Revolut held, and the question goes to whoever sets brokers' retention rules. Should it emerge that Revolut could have demanded deletion and did not, the gap is in how fintechs leave a vendor. And if most notified customers turn out to be US users of U.S. share trading ^[9], the old-records point shrinks to a footnote.

I think the evidence supports the narrow version of the retention case. A change of trading setup limits who can be exposed next and leaves the copies a vendor already holds in place. A count showing few non-US records would weaken that. A disclosure that the files were kept under a legal mandate would move the fault from the vendor to the regulation.

The money in the accounts is the part the companies can vouch for. Revolut says its own systems were not accessed and that customer funds and investments remain safe ^[14]. Contact details and employment information can be used to craft convincing phishing or impersonation attempts, according to Crowdfund Insider ^[13]. The legitimate notices also arrive by email, and some of DriveWealth's appear to have landed in spam folders ^[15]. Customers who received nothing are generally being told they are not in the notified group ^[15]. DriveWealth has recommended staying alert for unusual financial activity and, where relevant, considering credit monitoring or fraud alerts ^[16].

Revolut's earlier September incident, in which fraudulent requests from a compromised government email domain led it to release identity documents and transaction histories for a limited group ^[12], happened at Revolut itself. This one sits with a broker that several consumer apps rely on ^[11]. DriveWealth's retention practice therefore sets the exposure for their customers too. Revolut says it is still working with DriveWealth to pin down the exact scope ^[17].