On 24 September 2026, the Irish broadcaster RTE reported that Revolut customers in Ireland are among those affected by a data breach at DriveWealth, the American broker that used to execute United States stock trades for Revolut clients. According to Revolut, unauthorised persons accessed historical personal data, including names, email addresses, phone numbers, postal addresses, employment information, country of citizenship, age, gender and partial account numbers. Passwords, passcodes, card details, identity documents and payment information were not exposed, and customer funds remain safe. If you live in France and hold or used to hold a Revolut account, the question is direct: was your file part of those historical records, what can criminals do with that data, and which practical and legal steps protect you now? This article answers from the facts reported by RTE, then from European Union law as it applies in France: the General Data Protection Regulation (r\u00e8glement g\u00e9n\u00e9ral sur la protection des donn\u00e9es, the EU data protection regulation) and the case law of the Court of Justice of the European Union (Cour de justice de l’Union europ\u00e9enne, the EU supreme court for EU law). The second reported incident of September 2026, confirmed by Reuters on 12 September 2026, in which Revolut disclosed sensitive customer information after receiving fraudulent requests sent from a legitimate government agency email address, shows that customers of the same institution can be exposed twice in a few days through two different doors. The reasoning below applies to both situations: identify your exposure, secure your accounts, force the companies to answer, complain to the CNIL (Commission nationale de l’informatique et des libert\u00e9s, the French data protection authority) and, where you suffered harm, claim compensation before the French courts.<\/p>\n
The incident reported on 24 September 2026 did not start inside Revolut. RTE quotes the company explaining that the breach occurred at DriveWealth, described as a United States broker that carries out American stock trades for Revolut customers, and that the unauthorised access concerned historical personal data of some DriveWealth customers. Revolut states that its own systems and infrastructure were not accessed or compromised. That distinction matters for your analysis, because it determines who held your data, under which contract, and against whom you can act. When you traded American shares through the Revolut application, your identification data transited through an American intermediary. That intermediation chain is standard in online brokerage, and it is precisely why European law imposes duties on both the bank that collects your data and the service provider that processes it on its behalf.<\/p>\n
Time is the first filter. Revolut told RTE that in Europe the incident relates to historical records dating from before it changed its American stock trading model, with changes implemented between December 2023 and June 2025 depending on the market, and that since then individual customers’ personal details in those markets have not been shared with DriveWealth and are therefore not affected. In practice, if you opened your Revolut account recently and never traded American shares, or only traded them after the new model applied in France, your file should not be in the exposed set. If, on the contrary, you held American securities through Revolut before that migration, your data may have remained stored at the intermediary and may now be in the hands of an unauthorised third party. The exact boundaries by country and by date are something Revolut and DriveWealth must confirm individually, and the second part of this article explains how to force a written answer.<\/p>\n
The content of the exposed file is the second filter. The list communicated to customers covers customer profile data, meaning name, email address, phone number, postal address and employment information, plus biographical data such as country of citizenship, age and gender, as well as partial DriveWealth account numbers. Revolut adds that there is currently no reason to believe that any other personal information was affected, and in particular that no passwords and no financial payment information such as credit card or bank account details were involved. No Revolut password, passcode, card detail or identity document was exposed. That perimeter reduces some risks and increases others. Without passwords or card numbers, a direct emptying of your account through this file alone is not the expected scenario, and the company confirms that funds and investments are safe. With your real name, real phone number, real postal address, date-related and nationality data, and a partial account number used as a trust anchor, the realistic danger is targeted fraud: fake Revolut or tax-office calls quoting your personal details, SMS messages inviting you to unlock or migrate your account, emails reproducing the partial account number to look authentic. French criminal law punishes such fraud directly: Article 313-1 of the Code p\u00e9nal (the French criminal code) provides in French: “L’escroquerie est le fait, soit par l’usage d’un faux nom ou d’une fausse qualit\u00e9, soit par l’abus d’une qualit\u00e9 vraie, soit par l’emploi de manoeuvres frauduleuses, de tromper une personne physique ou morale et de la d\u00e9terminer ainsi, \u00e0 son pr\u00e9judice ou au pr\u00e9judice d’un tiers, \u00e0 remettre des fonds, des valeurs ou un bien quelconque, \u00e0 fournir un service ou \u00e0 consentir un acte op\u00e9rant obligation ou d\u00e9charge.” (Fraud is the act, whether by the use of a false name or a false capacity, by the abuse of a genuine capacity, or by fraudulent manoeuvres, of deceiving a natural or legal person and thereby inducing that person, to his or her prejudice or to the prejudice of a third party, to hand over funds, valuables or any property, to supply a service, or to consent to an act creating an obligation or a discharge.) The offence carries five years of imprisonment and a 375,000 euro fine, as stated in Article 313-1 of the Code p\u00e9nal<\/a>. Your protection nevertheless starts before any prosecution, by treating every unsolicited contact that uses your personal data as hostile until proven otherwise.<\/p>\n Geography is the third filter, and the one that connects an Irish news story to readers in France. The reporting focuses on Irish customers because the Irish press asked the question first, and the accessible figures mention about 680 customers identified worldwide, including 12 in Ireland. Those numbers describe identified cases at a given moment, not a ceiling, and they say nothing about France either way. Revolut serves several million customers in France, and a significant share of them trade or traded American shares, which is exactly the population whose historical records sat at DriveWealth. The search suggestions collected in Ireland alongside the trend, including the query “revolut france”, confirm that customers spontaneously look for the French dimension of the case. If you reside in France and traded American stocks through Revolut before the 2023 to 2025 migration window, act as potentially affected until you hold a written confirmation to the contrary. The steps below cost nothing and preserve your rights either way.<\/p>\n Start with the mailbox test, exactly as Revolut formulates it. DriveWealth has contacted affected customers directly, and Revolut followed up with its own explanatory email, so customers who received neither message are told they are not affected. Search all your inboxes, including spam folders and old addresses attached to the account, for messages from DriveWealth and from Revolut dated September 2026 mentioning a security incident. Keep every message with its full headers, and take dated screenshots, because those emails are your proof of when you were informed and of what you were told. If you received the email, you are in the affected group and the legal section of this article concerns you directly. If you received nothing, you remain in the watch group: the absence of an email is reassuring but does not replace a written individual confirmation, which you can demand under the access right explained below.<\/p>\n Treat the next phone call, SMS or email as the real attack surface. With your name, phone number, address and partial account number circulating, fraudsters can build credible scripts: a caller claiming to work for Revolut fraud prevention who quotes your address and the partial account number, then asks for your passcode, a validation code or a transfer to a safe account. Revolut will never ask for those secrets, and no genuine procedure requires you to move funds to protect them. Hang up, open the application yourself through its official icon, and check for alerts there. Activate or verify two-factor authentication (authentification \u00e0 deux facteurs, a second code in addition to the password), review connected devices and active sessions, change your email password and your Revolut passcode even though they were not part of the exposed file, and set transaction notifications to the lowest threshold. For American stock positions, verify through the application that your holdings and corporate-action elections are intact, and download your statements for September 2026 so that any later anomaly can be dated.<\/p>\n Build your evidence file from day one, because compensation later depends on proof today. Save the alert emails, your account statements, a dated note describing each suspicious contact with the number used and the exact words spoken, and any loss or expense, however small: blocked card replacement, hours spent securing accounts, professional fees, a refused transaction while travelling. Under European law, even non-financial harm such as anxiety, loss of control over your data or time wasted dealing with the consequences can count as compensable damage, as the Court of Justice confirmed in 2023 and as detailed in the second part. Also file a report on the French official cyber-malveillance platform and keep the receipt, and if an actual fraud attempt targets you, file a criminal complaint (plainte, a formal complaint to the police or prosecutor) and keep the registration number. French criminal law protects personal data as such, beyond fraud alone. Article 226-17 of the Code p\u00e9nal punishes processing without the required security measures: “Le fait de proc\u00e9der ou de faire proc\u00e9der \u00e0 un traitement de donn\u00e9es \u00e0 caract\u00e8re personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016 pr\u00e9cit\u00e9 ou au 6\u00b0 de l’article 4 et aux articles 99 \u00e0 101 de la loi n\u00b0 78-17 du 6 janvier 1978 pr\u00e9cit\u00e9e est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” (The act of carrying out or having carried out personal data processing without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016\/679 of 27 April 2016 or in Article 4(6) and Articles 99 to 101 of Act No. 78-17 of 6 January 1978 is punished by five years of imprisonment and a 300,000 euro fine.), as stated in Article 226-17 of the Code p\u00e9nal<\/a>. Fraudulent collection itself is a separate offence under Article 226-18 of the Code p\u00e9nal<\/a>: “Le fait de collecter des donn\u00e9es \u00e0 caract\u00e8re personnel par un moyen frauduleux, d\u00e9loyal ou illicite est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” (The act of collecting personal data by fraudulent, unfair or unlawful means is punished by five years of imprisonment and a 300,000 euro fine.). These two offences sit within the chapter of the Code p\u00e9nal on offences against individuals resulting from files and computer processing. Each dated document turns an abstract breach into an individual case file that a lawyer, the CNIL or a court can use.<\/p>\n European law places the primary burden on the company that decided why and how your data is processed, and a second layer of duties on the provider that handled it on its behalf. Revolut, which collected your identity to open and operate your account, is the controller (responsable du traitement, the entity that determines the purposes and means of processing). DriveWealth, which executed the American trades with data Revolut transmitted, acted as the processor (sous-traitant, the entity that processes data on behalf of the controller). Article 28, paragraph 1, of Regulation (EU) 2016\/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the General Data Protection Regulation) requires controllers to use only processors that provide sufficient guarantees of appropriate technical and organisational measures. Choosing an intermediary, keeping historical files there after a migration, and supervising its security are therefore not internal IT matters: they are legal obligations of Revolut itself, as set out in the General Data Protection Regulation on EUR-Lex.<\/p>\n Security is an obligation of result in its design, even if no system is perfect. Article 32, paragraph 1, of the same Regulation requires controllers and processors to implement technical and organisational measures ensuring a level of security appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing. The text lists pseudonymisation, encryption and means guaranteeing confidentiality, integrity, availability and resilience as examples. A processor that leaves historical customer files readable to an intruder, or a controller that keeps transmitting or storing data at a provider without verifying those measures, will have to explain itself on this exact ground before the supervisory authority and, if necessary, before a court, under the General Data Protection Regulation on EUR-Lex.<\/p>\n Once the breach is known, two notifications must follow, and each has a deadline. The processor must warn the controller immediately: Article 33, paragraph 2, of the same Regulation requires the processor to notify the controller of any personal data breach without undue delay after becoming aware of it. The controller must then notify the competent supervisory authority: Article 33, paragraph 1, of the same Regulation then requires the controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to create a risk for the rights and freedoms of individuals. For customers, the decisive message is the direct one: Article 34, paragraph 1, of the same Regulation requires the controller to communicate the breach directly to the affected individual without undue delay where the breach is likely to create a high risk for that person’s rights and freedoms. That communication must describe the breach in clear and simple terms and contain at least the contact point, the likely consequences and the measures taken. Compare the emails you received against that checklist: missing consequences, missing contact, or vague wording is itself a fact to mention in your complaint, assessed against the General Data Protection Regulation on EUR-Lex.<\/p>\n Send a written request that compels an individual answer. Address Revolut, by email and through the application’s messaging system, a dated message asking for confirmation whether your personal data was part of the DriveWealth incident, the exact categories of data concerned, the date on which Revolut learned of the breach, the date on which the authority was notified, a copy of the notification sent to you, and the identity and contact of the data protection officer (d\u00e9l\u00e9gu\u00e9 \u00e0 la protection des donn\u00e9es, the officer in charge of data protection compliance). Ask separately for access to all your personal data still held by Revolut and formerly transmitted to DriveWealth, and for written confirmation of what has been deleted since the migration of the American trading model. French law backs that demand directly: Article 49 of the Loi n\u00b0 78-17 du 6 janvier 1978 relative \u00e0 l’informatique, aux fichiers et aux libert\u00e9s provides that “Le droit d’acc\u00e8s de la personne concern\u00e9e s’exerce dans les conditions pr\u00e9vues \u00e0 l’article 15 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The data subject’s right of access shall be exercised under the conditions laid down in Article 15 of Regulation (EU) 2016\/679 of 27 April 2016.), as stated in Article 49 of the Loi Informatique et Libert\u00e9s<\/a>, and the same article empowers the competent court, including in summary proceedings, to order any measure preventing concealment or disappearance of the data. The information duty mirrors it: Article 48 of the Loi Informatique et Libert\u00e9s<\/a> states that “Le droit \u00e0 l’information s’exerce dans les conditions pr\u00e9vues aux articles 12 \u00e0 14 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The right to information shall be exercised under the conditions laid down in Articles 12 to 14 of Regulation (EU) 2016\/679 of 27 April 2016.). Set a one-month deadline, keep proof of sending, and keep the reply. Silence, an evasive reply, or a reply that contradicts the public statements becomes an exhibit for the CNIL complaint and for the damages claim.<\/p>\n The complaint to the authority is your administrative lever, and in France it goes to the CNIL. Article 77, paragraph 1, of the same Regulation gives every data subject the right to lodge a complaint with a supervisory authority, in particular in the Member State of habitual residence, place of work or place of the alleged infringement. A customer residing in France therefore complains to the CNIL under Article 77 of the General Data Protection Regulation on EUR-Lex, online through its complaint service, attaching the alert emails, the written request sent to Revolut and its reply, and the evidence file built in the first part. Because the controller and the processor operate across borders, the CNIL cooperates with its counterparts under the consistency mechanism, but your entry point remains French, in French, from your place of residence. The authority can investigate, order compliance, and fine. Under French domestic law, Article 20 of the Loi n\u00b0 78-17 du 6 janvier 1978 relative \u00e0 l’informatique, aux fichiers et aux libert\u00e9s (the French Data Protection Act) provides that “le pr\u00e9sident de la Commission nationale de l’informatique et des libert\u00e9s peut le rappeler \u00e0 ses obligations l\u00e9gales ou, si le manquement constat\u00e9 est susceptible de faire l’objet d’une mise en conformit\u00e9, prononcer \u00e0 son \u00e9gard une mise en demeure, dans le d\u00e9lai qu’il fixe” (the President of the Commission nationale de l’informatique et des libert\u00e9s may remind the controller of its legal obligations or, where the observed breach is capable of being remedied, issue a formal notice to comply within a deadline set by the President), as stated in Article 20 of the Loi Informatique et Libert\u00e9s<\/a>, whose consolidated text is available on L\u00e9gifrance. The authority can therefore first order Revolut or its processor to comply, before or alongside any fine: Article 83, paragraph 1, of the same Regulation requires supervisory authorities to ensure that administrative fines are effective, proportionate and dissuasive in each individual case. Fines of up to 10 million euros or 2 percent of worldwide annual turnover apply to breaches of the controller and processor duties, and up to 20 million euros or 4 percent to breaches of the core principles and of data subjects’ rights. The fining rules are laid down in the General Data Protection Regulation on EUR-Lex.<\/p>\n The damages claim is your judicial lever, and it can be brought in France. Article 82, paragraph 1, of the same Regulation gives anyone who has suffered material or non-material damage as a result of an infringement a right to receive compensation from the controller or processor. The same article adds that each controller or processor involved in the same processing is liable for the entire damage, so that the victim obtains effective redress, and that a controller or processor escapes liability only by proving that the event causing the damage is in no way attributable to it. Crucially, jurisdiction follows you home: Article 79, paragraph 2, of the same Regulation allows proceedings against a controller or processor to be brought either where the controller or processor is established or, alternatively, before the courts of the Member State where the data subject habitually resides. A Revolut customer habitually resident in France can therefore sue before the French courts, including against the American processor for the part of the processing it performed, pursuant to the General Data Protection Regulation on EUR-Lex.<\/p>\n The Court of Justice removed the heaviest obstacle to these claims on 4 May 2023 in the \u00d6sterreichische Post judgment, case C-300\/21. The Court held, first, that a mere infringement is not enough on its own: three conditions must all be proven, namely an infringement of the Regulation, damage suffered, and a causal link between the two. It held, second, that national law may not make compensation for moral damage conditional on the harm reaching a certain degree of seriousness. No seriousness threshold applies, in other words: the anxiety of knowing your identity file circulates, the loss of control over your data, and the hours spent protecting your accounts are compensable as moral damage even without a financial loss. Third, the amount is set by the national court applying its domestic rules on the extent of financial compensation, provided the principles of equivalence and effectiveness of European Union law are respected. For the DriveWealth file, the infringement to plead is concrete: storage of historical data at a processor, breach of the security and notification chain, and, depending on the reply received, breach of the information duties. Your evidence file converts each of those points into euros: documented time, documented expenses, documented anxiety through dated steps taken, and any proven fraud or attempted fraud using the exposed data.<\/p>\n Readers who suffered a comparable exposure through a French organisation will find the same method applied to a domestic case in our analysis of the Afpa cyberattack and the 1.7 million victims it affected, which details the complaint and compensation path step by step: Donn\u00e9es personnelles pirat\u00e9es : que faire apr\u00e8s la cyberattaque visant l’Afpa<\/a>. The facts differ, since the Afpa case was a direct attack on a French body while the Revolut case passes through an American processor, but the two levers are identical: supervisory complaint from your country of residence, then damages before your home court.<\/p>\n The DriveWealth incident is a textbook cross-border data case: an Irish news story, an American broker, a European bank, and customers in France whose historical stock-trading files may have been exposed. Your response follows four verbs in this order: verify, secure, compel, claim. Verify whether your file sat at the intermediary by searching the September 2026 emails and demanding a written individual answer. Secure your accounts and treat every contact quoting your personal data as a fraud attempt. Compel Revolut and DriveWealth to meet their duties of security, notification and information, in writing and within deadlines. Claim through a CNIL complaint from France and, where harm exists, through a damages action before the French courts, where European case law requires no minimum level of suffering for moral damage. Keep every document, because in data cases the best file wins. The reporting that revealed this breach is the RTE business coverage of 24 September 2026 and the Reuters dispatch of 12 September 2026 on the separate fraudulent-request incident, both linked in this article as fact sources for the events described.<\/p>\n Phone consultation within 48 hours with a lawyer of the firm, in Paris and \u00cele-de-France. Call 06 46 60 58 22<\/a> or write through our contact page<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Revolut France customers who traded US stocks may be affected by the DriveWealth data breach reported on 24 September 2026. How to check your exposure, force answers, complain to the CNIL and claim compensation before the French courts.<\/p>\n","protected":false},"author":251031309,"featured_media":16583,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kj_source_type":"","_kj_official_id":"","_kj_official_url":"","_kj_judilibre_id":"","_kj_jur":"","_kj_lieu":"","_kj_chambre":"","_kj_rg":"","_kj_date":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[80314,80316],"tags":[],"class_list":["post-2129840","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decryptage","category-numerique-donnees-personnelles"],"yoast_head":"\nB. How to check the alert email and lock down your accounts today<\/h3>\n
II. DriveWealth breach through Revolut: how to enforce your rights from France<\/h2>\n
A. Force Revolut and DriveWealth to comply with their European data duties<\/h3>\n
B. Complain to the CNIL in France and claim compensation before the French courts<\/h3>\n
Conclusion<\/h2>\n
Need a quick opinion on your case<\/h2>\n