Revolut sended personal information to some random guys and didnt check if they are really from goverment?

Overview

Just saw that a few day ago Revolut confirmed that someone sent it data requests from a real government agency email domain. The requests were fake. Revolut answered them anyway. They sended: names, dates of birth, home addresses, passport and driving licence scans, verification selfies, IBANs, account statements and transaction histories. Revolut says only a "very limited group" of customers was affected and no passwords or funds were touched. I keep thinking about what I'd do if

SpinGraph analysis pending — check back after processing.