Revolut Reports Data Breach Due to Fraudulent Government Email Requests
Revolut has confirmed it has experienced a data breach affecting some of its customers. On September 14, a spokesperson for the company stated that an unauthorized third party submitted fraudulent requests for customer information using an email domain associated with a legitimate government agency. This incident has been described by Revolut as a sophisticated external impersonation scam that led to the disclosure of sensitive information to the threat actor.
The requests made by the impersonators included valid technical domain authentication, which led Revolut employees to fulfill these requests as part of standard legal compliance. The British fintech firm emphasized that only a very limited group of customers was impacted by this breach, assuring that its systems and customer funds remained secure.
While Revolut did not disclose the exact number of affected customers or specify if any particular market or department was involved, the company took swift action upon detection of the breach. Its security team blocked the fraudulent email address, informed the affected customers, and alerted the relevant government agency, as well as enforcement and regulatory bodies.
On September 12, independent crypto-security researcher ZachXBT raised alarms about the breach through a Telegram post, sharing a customer notification sent by Revolut the previous day. Reports indicate that the compromised data includes full names, dates of birth, residential addresses, phone numbers, email addresses, occupations, and copies of government identification documents such as passports and driver's licenses, along with verification selfies.
Concerns Over Financial Data Exposure
Additionally, ZachXBT claimed that sensitive financial information was also exposed, including International Bank Account Numbers (IBANs), account-opening dates, complete transaction histories, and Bitcoin wallet reference numbers. In light of this breach, cybersecurity experts have raised concerns regarding the adequacy of Revolut's verification processes for third-party data requests, particularly given the sensitive nature of the information handled by the fintech.
Muhammad Yahya Patel, vCISO and cybersecurity advisor at Huntress, pointed out that for a company focused on digital identity verification, the standards for verifying third-party requests should be exceptionally high. He questioned why a regulated financial institution handling sensitive data did not have more rigorous verification controls in place.
Filed & Cleared
Jamie Akhtar, CEO and co-founder of CyberSmart, cautioned that while Revolut stated that customer funds and systems were unaffected, the exposed information could still be exploited for identity fraud and targeted phishing attacks. Patel further warned that the range of compromised data goes beyond a standard data breach notification, effectively creating a comprehensive identity theft kit for the perpetrators.
Affected customers are advised to remain vigilant for unexpected communications claiming to be from Revolut or other trusted organizations. They should avoid disclosing passwords or security codes and should only contact Revolut through its official app or verified website. Akhtar also recommended that users of any digital financial services enable multi-factor authentication, use unique passwords, and monitor their accounts and credit reports for unusual activity.
