Revolut Confirms Second Data Breach Tied to DriveWealth Partner

What happened

Revolut has confirmed that some of its customers were affected by a data breach linked to DriveWealth, the US-based brokerage partner that underpins part of Revolut's trading services. The incident marks the second security-related disclosure involving Revolut customer data within a matter of days, according to Finextra.

Details of the DriveWealth incident itself originated with the broker rather than Revolut's own systems, but the exposure has nonetheless reached Revolut account holders whose data was processed through the partnership. Revolut has not disclosed the scope of the affected customer base or the categories of data involved.

Why it matters

For a digital-first bank whose entire value proposition rests on trust in its app and infrastructure, repeated security incidents — even ones originating with a third-party partner — carry disproportionate reputational weight. Customers of neobanks rarely distinguish between "our systems" and "our partner's systems"; a breach is simply a breach, and responsibility is assumed to sit with the brand they bank with.

The episode also underscores a growing risk vector for fintechs built on layered partnerships: as firms like Revolut outsource specialist functions such as brokerage execution, their data-security posture becomes only as strong as the weakest vendor in the chain. This has implications well beyond fintech — any organisation relying on third-party processors for customer data needs to treat vendor risk management as a core trust-and-safety discipline, not a procurement afterthought.

The Renascence take

Two disclosures in close succession will register with customers as a pattern, regardless of whether the underlying causes are related or technically distinct.

Most coverage will focus on who's technically at fault — Revolut or DriveWealth. That's the wrong question for customer trust. What matters behaviourally is cumulative signal: two breaches in days reads as "this is happening to me," not "this was a one-off vendor issue." Revolut's real test now is response design — fast, plain-language, proactive communication that explains exposure and next steps before customers have to ask. Firms that over-communicate during a second incident recover trust faster than those that rely on legal-safe statements; silence or vague reassurance in week two of a breach cycle is read as evasion, not caution.