DriveWealth breach exposes data of Revolut, Stake and Hatch brokerage customers

On 24 September 2026, US brokerage DriveWealth confirmed that a social-engineering attack had exposed historic personal data belonging to customers of fintech platforms that had used its embedded-investing infrastructure — among them Revolut, Australia's Stake, and New Zealand's Hatch. The intrusion into DriveWealth's network took place on 4 and 5 September 2026; the company blamed a "sophisticated social engineering campaign" by unknown third parties rather than a technical exploit.

For Revolut customers, the data potentially at risk included names, email addresses, phone numbers, postal addresses, employment details and part of a DriveWealth account number. DriveWealth said it found no unauthorized trades, transfers, withdrawals or account-balance changes, and that no passwords, passcodes, card details or identity documents were compromised. Neither DriveWealth nor the affected fintechs disclosed a total number of impacted customers.

Historic data caught in the net

Revolut used DriveWealth to support US stock trading for its customers, and the exposed records dated from the period when those customers held accounts directly with the broker — Revolut said it had transitioned users away from DriveWealth between December 2023 and June 2025. DriveWealth said regulatory record-retention requirements obliged it to keep the data even after the business relationship ended, which is why information on former users remained in its systems to be stolen.

Why it matters

The incident was the second data-security episode to hit Revolut customers in September 2026 alone, following an earlier case in which criminals abused a legitimate government agency's email domain to submit fraudulent data requests. Together they illustrate a recurring weakness of the embedded-finance model: a fintech's customers can be exposed through a back-end partner they never chose and may not even know exists. Because the stolen fields are exactly what attackers need for convincing phishing and impersonation, notified customers were urged to treat unexpected messages with caution. With access blocked and no financial loss reported, the incident's status was recorded as contained.