British fintech company Revolut has disclosed sensitive customer information to an unauthorised third party after fraudsters used a legitimate government agency email domain to submit fake requests for customer data.

The company said a “limited” number of customers were affected by the incident, although it did not disclose the exact number of people whose information was exposed.

In a notification sent to affected customers, the compromised information included personal and contact details such as dates of birth, postal and email addresses, and phone numbers, according to TechCrunch.

The data also included copies of identity documents, including passports and driving licences. Revolut said verification selfies, account statements and transaction histories may also have been exposed.

A Revolut spokesperson said the affected customers had been contacted directly.

The fintech did not disclose the government agency whose email domain was used in the fraudulent requests. It also declined to say whether the incident was confined to a particular market.

“Revolut recently identified a sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information,” the spokesperson said.

Revolut told TechCrunch that it blocked the email address used in the scam after discovering that an unauthorised third party had obtained customer information through fraudulent requests.

The fintech said it also notified the government agency whose email domain was used, as well as law enforcement authorities and relevant regulators.

“Revolut systems and customer funds are unaffected,” the company said.

London-based Revolut has more than 80 million customers worldwide and operates as a bank in more than 30 countries, according to information on its website.

The fintech has also expanded into markets including India, Mexico, France and the United Arab Emirates.