A fake government email slipped through security controls at digital banking giant Revolut this week, exposing residential addresses, identity documents and bitcoin transaction histories belonging to a wide group of customers.

The request appeared to come from a legitimate government agency and carried credentials that passed Revolut’s checks. The company handed over customer information before separately contacting the agency and discovering that the request was fraudulent, according to notices sent to affected users.

The files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including all bitcoin activity.

Revolut has yet to disclose how many customers were affected, and did not immediately respond to a CoinDesk request for comment on the matter.

It said in its email that customer funds remained safe and has since notified affected users and regulators and blocked the source of the request.

The weak point was authorization. Once the request cleared Revolut’s internal checks, someone posing as a government official gained access to the same deeply personal information the bank had collected to satisfy identity and compliance requirements.