In September 2022, Revolut confirmed a targeted cyberattack exposed the personal data of 50,150 customers (0.16% of its user base). Attackers used social engineering to gain access to Revolut's database, accessing names, email addresses, phone numbers, and partial payment card data. No PINs or passwords were exposed. The breach raised concerns about database security practices at one of Europe's fastest-growing neobanks, which had 20 million customers at the time.