Revolut’s paperwork breach shows why insurers are rethinking what counts as a ‘cyber attack’

Revolut handed customer data to an attacker using a spoofed government email, prompting insurers to rethink cyber attack coverage definitions.

Revolut disclosed customer data after receiving a request from what appeared to be a genuine government email address; no servers were breached and no malware was involved. The social engineering incident has become a test case for how cyber insurers define a 'cyber attack'. The report is by Matthew Sellers. It highlights a growing gap between technical intrusions and data-loss incidents caused by impersonation.

• Attacker impersonated a government email address to obtain customer data from Revolut.
• No server compromise or malware; data was handed over in response to the request.
• Insurers are reconsidering whether such incidents count as a 'cyber attack' for coverage.
• Incident illustrates social engineering risks outside traditional hacking definitions.