Revolut Reports Data Breach Affecting Customer Financial Information
Revolut, a prominent fintech company, has revealed a data breach that involved sharing customer information with a threat actor impersonating a government agency. The breach affects an undisclosed number of customers and has raised significant concerns regarding data security in the financial sector.
Operating in over 160 countries, Revolut provides banking, money management, and investment services to more than 80 million customers, including 800,000 businesses. In communications sent to those affected, the company detailed how the attacker requested personally identifiable information (PII) via email, using a domain that appeared to belong to a legitimate government agency.
According to Revolut, the request for customer information seemed authentic due to valid domain authentication credentials, leading the company to fulfill the request under the belief that it was legitimate. The data shared with the threat actors included sensitive identity details such as full names, dates of birth, occupations, and contact information, including postal addresses, email addresses, and phone numbers. Additionally, copies of identity documents like passports and driver's licenses, along with facial verification images, were also compromised.
Extent of Data Compromised in Breach
The breach also exposed account statements, withdrawal records, and full transaction histories, including Bitcoin transactions. Despite the severity of the incident, Revolut has stated that the breach affects a "very limited" number of customers but has not disclosed the exact figure. The company reassured customers that its systems and their funds remain secure.
Cleared for Release
Upon discovering the breach, Revolut promptly blocked the unauthorized email address and notified the relevant government agency, as well as law enforcement and data protection regulators. Crypto fraud investigator ZachXBT noted that while the breach likely impacts a small number of users, it appears to have been targeted at high net worth individuals.
This incident is not the first for Revolut; the company previously disclosed a data breach in September 2022, where the personal, contact, and financial information of over 50,000 customers was compromised. As the fintech landscape continues to evolve, the security of customer data remains a critical concern for companies like Revolut and their users.
