Neobank Revolut has been hit by a data leak affecting European customers, including Belgian residents, according to available reports. Details on the nature of the exposed data and any potential impact in Canada have not been disclosed at this stage.
Key points
- Revolut, a digital financial institution used in Quebec, has reported a leak affecting European customers, including Belgian residents.
- No official confirmation exists to date of any impact on Quebec or Canadian customers of the service.
- The exact nature of the exposed data and the cause of the leak remain undisclosed according to available reports.
- The incident illustrates the risk SMBs face from reliance on digital financial providers, a matter Law 25 addresses directly.
What exactly is known about this incident?
According to available reports, Revolut suffered a leak affecting European customers, including Belgian residents. The type of data exposed, the exact cause, and the true scope of the incident have not been made public, and no confirmed link to Quebec customers exists to date.
The limited information made public makes it difficult to assess the risk precisely at this stage. Neither the technical cause (misconfiguration, unauthorized access, exploited vulnerability) nor the extent of the data involved is established in the available sources. We are therefore deliberately avoiding speculation about specific figures or a precise origin until they are confirmed.
Does this incident really concern Quebec SMBs?
Revolut is a service used by individuals and some businesses in Canada. No confirmation indicates a direct impact on Quebec customers, but the incident is a reminder that a digital financial provider used by an SMB can be affected by an event occurring abroad, with possible local consequences.
A Quebec SMB does not need to be directly targeted to feel the effects of an incident at a provider. A business account, access credentials, or payment information passing through a third party platform constitutes a risk surface that partly falls outside the client company’s direct control. This kind of dependency is precisely what deserves to be mapped out, regardless of whether a Quebec impact is confirmed in this particular case.
What does Quebec law say about this type of incident?
In Quebec, Law 25 requires any organization that has reason to believe a confidentiality incident presents a risk of serious harm to keep an incident register and notify the Commission d’accès à l’information (Quebec’s access to information oversight body), without this prejudging whether that obligation applies to the Revolut case.
This obligation applies to the organization holding the personal information, not only to the one directly compromised upstream. An SMB that entrusts data to a provider remains responsible, toward its own customers, for how it manages and communicates an incident affecting that provider. This is a general framework applicable to any business subject to the law, not a statement about what occurred at Revolut.
How can you reduce your exposure to this type of risk?
No measure eliminates the risk associated with a third party provider, but several basic practices make this kind of scenario considerably harder to exploit and limit its consequences: strong authentication, an inventory of critical providers, and an incident response procedure drafted before an event occurs.
Concretely, this starts with listing the external services that hold your organization’s personal or financial information, then enabling multi-factor authentication everywhere possible, including on accounts used for those services. The Canadian Centre for Cyber Security offers baseline controls tailored to small and medium organizations, which remain relevant regardless of the outcome of this particular case.
FAQ
If I use Revolut, has my information been exposed?
Current public information points to European customers, including Belgian residents, being affected by this leak, with no confirmation of an impact on Quebec or Canadian users. We have no details allowing us to say whether Canadian accounts are affected. If you use this service, standard caution applies: watch for official communications from Revolut, check your account activity, and be wary of any unsolicited message asking you to confirm credentials, a common tactic following this type of incident, whether or not it is related to this one.
Is a Quebec SMB liable if one of its providers suffers a data leak?
An SMB’s legal responsibility toward its own customers does not disappear because the leak occurred at a provider. Law 25 sets out the obligations of any organization subject to it regarding the protection of personal information entrusted to third parties, including the need to assess the risks tied to those partners. This does not mean a fault was committed in every case, but that assessing the contractual relationship and the provider’s security measures is part of reasonable risk management, regardless of the outcome of the Revolut case.
What should I do if I suspect my information was compromised in an incident like this?
In the absence of official confirmation concerning you, the first step is to monitor the provider’s official channels rather than react to unverified messages. Change your passwords as a precaution, avoiding reuse elsewhere, and enable multi-factor authentication if you have not already done so. For a business, it is useful to document the situation in an internal register, even without certainty, in order to demonstrate reasonable vigilance if the situation evolves.
Sources
- Le Soir · press, 2026
- Commission d’accès à l’information du Québec · obligations, incident register and notification
- Canadian Centre for Cyber Security: baseline cybersecurity controls for small and medium organizations · baseline control checklist
