British digital bank Revolut said Wednesday that an impersonation attack caused it to share customers' information with an "unauthorised third party" posing as a government agency.
According to a source familiar with the matter, 680 Revolut customers across several European countries were affected by the hack.
Revolut said its systems and customer funds had been left "unaffected".
"We have contacted the limited number of impacted individuals directly to inform them and provide support," it added in a statement.
Revolut said it "recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information."
"Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection and financial regulators," the statement said.
Britain's data protection regulator, the ICO, confirmed to AFP that it had "received a report" regarding the breach and was "assessing the information provided".
Italian media reported that the emails allegedly originated from the Italian prefecture of Reggio Calabria -- a claim AFP has not yet been able to verify. The Italian data protection authority has meanwhile asked all Italian banks to review their data access systems and report any security vulnerabilities, while Italian police have opened an investigation, the authorities confirmed to AFP.
An email sent to affected customers late last week and viewed by AFP details that the data breach involved addresses, verification photos, identity documents, information regarding banking activity and bitcoin holdings. Among them, French entrepreneur Mark Karpeles said he contacted the police in Japan -- where he lives -- and checked into a hotel with his family as a precaution.
He pointed to the fact that France had experienced the kidnapping of crypto entrepreneurs. "I am a bit further away (from France) and therefore a harder target to reach," explained the former head of Mt. Gox to AFP.
The bitcoin exchange went bankrupt in 2014 following a hack and he was convicted of electronic data manipulation in connection with the case.
The Financial Times reported that it had made contact with the hackers claiming responsibility for the incident who reportedly exchanged emails with the bank for several months under the false identity, targeting clients holding large volumes of crypto-assets, particularly in France and Switzerland.
It comes as Revolut is making inroads in the global banking sector following its creation in 2015.
It secured a long-awaited banking licence in its home market Britain in March, lifting restrictions on its ability to compete with established retail lenders. This month Revolut secured conditional approval for a US banking licence, and on Tuesday it filed for a licence application in Switzerland.
The fintech reached a valuation of $115 billion in a secondary share sale in July.
It has been a leader in rolling out financial services via smartphones, initially focusing on allowing customers to easily exchange currencies and make transfers. Revolut has more than 80 million customers globally and is targeting 100 million customers in 100 countries.
But its rapid growth has drawn criticism, in particular over its ability to comply with financial regulations aimed at combating fraud and money laundering.