Revolut Reports Data Breach Linked to Fake Government Emails
Revolut, the British fintech giant, has confirmed a data breach that occurred after its compliance team was deceived by a spoofed email impersonating a government agency. The company disclosed this incident on September 12, revealing that sensitive customer information was shared in response to fraudulent data requests. The emails were sophisticated enough to pass standard email authentication checks, including SPF, DKIM, and DMARC, which are designed to verify the legitimacy of the sender.
The compromised data included full names, birth dates, contact information, copies of identification documents, transaction histories, and account statements. However, Revolut emphasized that no biometric data was shared, and customer funds remained secure. The exact number of affected users has not been disclosed, but reports suggest that a select group of higher-net-worth individuals may have been specifically targeted. On-chain analyst ZachXBT noted that the scale of the incident appeared to be limited.
Customer notifications began circulating on September 11, just a day before the public confirmation. Revolut characterized the breach as a "sophisticated external impersonation scam," highlighting the technical prowess of the attackers. The fraudulent emails successfully passed all three major email authentication protocols, which raises concerns about the effectiveness of existing security measures.
Revolut's Actions Following the Breach
In response to the breach, Revolut has taken several actions, including blocking the fraudulent email address, notifying regulatory bodies and law enforcement, and reaching out to the government agency that was impersonated. The company has not publicly identified which agency was spoofed, but it is clear that this incident poses significant risks for customers, particularly regarding identity theft and targeted phishing attacks.
Clearance Granted
This incident is not Revolut's first encounter with data security issues. The company previously experienced a breach in 2022 that affected tens of thousands of customers due to unauthorized access through social engineering. The current breach, however, targets the compliance process itself rather than individual employee credentials, indicating a shift in the tactics employed by cybercriminals.
As Revolut continues to expand its operations across Europe and beyond, the timing of this breach is particularly concerning. The company has ambitions for a public listing, and incidents like this could undermine customer trust and confidence in its security measures. For customers, the immediate risk is not financial but informational, as the exposed data could be exploited for identity theft and other malicious activities.
