Fintech Firm Discloses Breach After Sending Data to Impersonator
Revolut has disclosed a data breach after sending customer data to an attacker who impersonated a government agency. The attacker used a spoofed domain that passed authentication checks, leading Revolut staff to fulfill what appeared to be a legitimate data request. The exposed information includes identity documents, transaction history and account statements. The company says the breach affects a limited number of customers. Revolut has blocked the fraudulent address and notified regulators and law enforcement.
How the Breach Occurred
The attacker requested customer data via email using a government agency domain. According to Revolut, the communication carried valid domain authentication credentials, so staff fulfilled the request under the reasonable belief that it was an authentic government agency request.
Revolut is a fintech firm that serves tens of millions of individual and business customers across many countries.
What Information Was Exposed
Revolut told affected customers that the breach exposed identity details including full name, date of birth and occupation. Contact details include postal address, email address and telephone number. Document data includes copies of identity documents such as passports and driver's licenses, plus facial verification images provided during account opening.
The exposed information also includes account statements with IBAN numbers, withdrawal records and full transaction history including Bitcoin transactions.
How Many Customers Were Affected
Revolut told BleepingComputer that the breach affects a limited number of customers but refused to disclose an exact figure. According to crypto fraud investigator ZachXBT, the incident seems to have been targeted at high net worth users.
The company has sent email notifications to affected individuals.
Company Response and Regulators Notified
Upon detection, Revolut blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection authorities and financial regulators. A Revolut spokesperson stated that Revolut systems and customer funds are unaffected.
The company has not disclosed how long the attacker had access to the data before detection or whether any follow-up fraud has been observed.
Previous Breach Four Years Ago
Revolut disclosed another data breach that affected 50,150 customers in September 2022. Attackers stole personal, contact and financial information in that incident. The company has not stated whether the current breach shares any connection to the earlier event.
What You Should Do
If you received a breach notification from Revolut, monitor your accounts for unauthorized transactions and suspicious contact attempts. Do not trust emails or calls that reference specific transaction amounts or account numbers unless you initiate the contact through official channels.
Consider placing fraud alerts or credit freezes with consumer credit reporting agencies if your passport or driver's license copy was exposed. Report any fraudulent activity to Revolut and to local law enforcement.
- Monitor your accounts for unauthorized transactions and suspicious contact attempts
- Do not trust emails or calls that reference specific account details unless you initiate the contact through official channels
- Consider placing fraud alerts or credit freezes with consumer credit reporting agencies if your identity documents were exposed
- Report any fraudulent activity to Revolut and to local law enforcement
Questions readers ask
How did the attacker get Revolut to send customer data?
The attacker sent an email request using a domain that appeared to belong to a government agency. The email passed domain authentication checks, leading Revolut staff to fulfill what seemed to be a legitimate government data request.
What types of customer information were exposed in the Revolut breach?
Exposed data includes full name, date of birth, occupation, postal address, email, telephone number, copies of passports or driver's licenses, selfie verification images, account statements with IBAN numbers, withdrawal records and full transaction history including Bitcoin transactions.
How many Revolut customers were affected by this breach?
Revolut told BleepingComputer that a limited number of customers were affected but refused to share an exact figure. Crypto fraud investigator ZachXBT noted that the incident seems to have been targeted at high net worth users.
Are my Revolut funds at risk after this breach?
Revolut stated that customer funds and its systems are unaffected. The breach resulted from the attacker impersonating a government agency. However, you should monitor your accounts for any suspicious activity and be cautious of phishing attempts using your exposed information.
What should I do if I received a Revolut breach notification?
Monitor your accounts for unauthorized transactions and suspicious contact attempts. Do not trust emails or calls that reference specific account details unless you initiate the contact. If your passport or driver's license was exposed, consider placing a fraud alert or credit freeze with consumer credit reporting agencies.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.