Revolut discloses data breach exposing financial info, passports
Revolut disclosed a breach after a threat actor spoofing a government agency's email domain obtained customer passports, selfies, IBANs, and full transaction histories.
Revolut told affected customers that a threat actor sent a data request from an unauthorized email account on an official government agency's domain, carrying valid domain authentication credentials, and staff fulfilled it believing it legitimate. Exposed data includes identity details, contact information, passport and driver's license copies, KYC facial verification selfies, IBANs, withdrawal records, and full transaction histories including Bitcoin. Revolut calls the number of affected customers 'very limited' but refuses to give exact figures, while ZachXBT says high-net-worth users appear targeted. This follows a 2022 Revolut breach affecting 50,150 customers.
- Spoofed government agency email with valid domain authentication tricked Revolut into releasing customer data.
- Exposed passports, driver's licenses, KYC selfies, IBANs, and full transaction histories including Bitcoin.
- Revolut calls impact 'very limited' but won't give numbers; ZachXBT says high-net-worth users targeted.
- Second Revolut breach after 2022 incident affecting 50,150 customers.
From the original article
2 min read at bleepingcomputer.com
Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.