Revolut Confirms Data Breach Through Fake Government Requests
Revolut disclosed customers' IDs, selfies, and financial data to impostors sending fraudulent requests from a legitimate government email domain.
Revolut confirmed an unauthorized third party obtained sensitive customer records by submitting fraudulent information requests from a legitimate government agency email domain with valid domain authentication, which employees fulfilled as standard legal compliance. Exposed data reportedly includes names, dates of birth, addresses, phone numbers, email addresses, occupations, passport and driver's license copies, verification selfies, IBANs, account-opening dates, transaction and withdrawal histories, and Bitcoin wallet references. Revolut says only a 'very limited group of customers' was affected, that systems and funds were untouched, and that it blocked the address and notified the agency, law enforcement, and regulators. Researcher ZachXBT first publicized the breach via Telegram on September 12.
- Impersonators used valid authenticated government domain emails to extract customer data
- Exposed data includes passports, verification selfies, IBANs, and full transaction histories
- Revolut says systems and funds unaffected; 'very limited' customers impacted
- ZachXBT disclosed the breach via Telegram on September 12
- Experts warn exposed data enables identity theft and targeted phishing
From the original article
2 min read at infosecurity-magazine.com
An unauthorized party used a legitimate government email domain to fraudulently request Revolut customer data
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.