60
Revolut Exposed KYC Data After Fraudulent Government Email Passed Security Checks
Revolut handed over KYC documents, selfies, and Bitcoin transaction histories to attackers after a fraudulent email from a genuine government domain passed authentication checks.
Revolut confirmed on September 12, 2026 that it disclosed sensitive customer KYC data to an unauthorized third party after a fraudulent information request was sent from an email account operating inside a real government agency's domain, carrying valid domain authentication credentials. The exposed data included identity documents (passports, driver's licenses), verification selfies, birth dates, contact details, IBANs, account statements, and full transaction histories including Bitcoin. Revolut discovered the fraud only after independently verifying with the agency, blocked the sender, and notified law enforcement and financial regulators, but did not disclose the number of affected customers or the agency involved. Researcher ZachXBT assessed the operation was targeted at high-net-worth users, useful for fraud, impersonation, or extortion.
60
Revolut confirms customer data breach through fake government requests
Revolut disclosed customer identity data, including passports and possibly selfies, to an attacker using a legitimate government email domain.
Attackers impersonating a government agency used a legitimate agency email domain to submit fraudulent information requests, prompting Revolut to disclose customer identity and contact data to an unauthorized third party. Exposed data included birth dates, postal and email addresses, phone numbers, passport and driver's license copies, and possibly verification selfies, account statements, and transaction histories. Revolut said a limited number of customers were affected, blocked the email address, and notified the agency, law enforcement, and regulators, adding that systems and customer funds were unaffected. Security researcher ZachXBT reported the scam appeared to target high net worth users of the fintech, which serves over 80 million customers.
72
A WhatsApp zero-day exploit can cost several million dollars
60
60
ID verification giant IDScan confirms data breach with more than 150 million driver’s licenses stolen
ID verification firm IDScan confirms hackers stole over 150 million driver's license records, including names and license numbers, from its cloud.
IDScan confirmed that threat actors stole driver's license records — full names, license numbers, and other government ID numbers — from the company's cloud systems during a roughly year-long intrusion. Brian Krebs previously reported a dark web service exposing data on over 150 million US and Canada residents, including license photos and records of high-profile individuals such as Defense Secretary Pete Hegseth. The FBI is investigating, and IDScan indicated hackers apparently demanded payment for full access to the stolen cache; the investigation is ongoing.
92
It sure looks like hackers breached a major ID card verification service
Suspected breach of ID verification firm IDScan exposed over 150 million US and Canadian driver's licenses and passports, sold via dark web site Nexus.
Independent journalist Brian Krebs reported that a dark web site called Nexus is selling searchable access to more than 150 million driver's licenses and passports belonging to people in the United States and Canada, adding roughly 500,000 documents daily from a 'major identity verification company.' Krebs and researcher Zach Edwards identified Louisiana-based identity verification service IDScan as the likely source; Krebs' own license and Defense Secretary Pete Hegseth's records appeared in the database. The FBI confirmed it is looking into the incident and IDScan says it is investigating; Nexus went offline shortly after the report went live.
92
60
Hackers publish thousands of drivers’ data after breaching Florida motor vehicle database
ShinyHunters published hundreds of thousands of records from Florida's DAVID vehicle database, including SSNs and passports, after an unpaid ransom demand.
The ShinyHunters group published hundreds of thousands of files from Florida's DAVID motor vehicle database on its leak site, saying the victim did not pay a ransom. Stolen records include vehicle ownership certificates with names, addresses, and VINs, plus a smaller number of Social Security numbers, non-US passports, and immigration documents. FLHSMV confirmed the breach, which followed theft of a police officer's credentials stored on a personal device. It comes the same month as the IDScan hack exposing over 150 million driver's license images.
75
Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware
Apple sent mercenary spyware threat notifications to users in 110 countries, including Ukrainian military members, in what researchers call an unprecedented notification wave.
Apple notified an unspecified number of users in 110 countries that they may have been targeted by mercenary spyware attacks, bringing total notifications to over 150 countries since the program began in late 2021. Apple does not attribute the attacks but describes the alerts as high-confidence indicators of individual targeting against journalists, activists, politicians, and diplomats. Citizen Lab's John Scott-Railton called the geographic scale unprecedented, and Access Now reported a record number of help requests, with recipients including members of Ukraine's military. Apple advised users to update devices, enable 2FA and Lockdown Mode, and use Stolen Device Protection.
68
60
Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.
A September 15 joint advisory from the FBI, UK NCSC, and Dutch AIVD attributes the Windows spyware HEAVYGRAM (NCSC name CHOSEN BRICK) to Iran's Ministry of Intelligence and Security, with the campaign dating to autumn 2023 and targeting dissidents, journalists, and activists in the UK, US, Netherlands, and worldwide. Delivered via messages impersonating known contacts or tech support, the malware assigns each victim a dedicated Telegram bot for command-and-control and exfiltration, and can take screenshots, record microphone audio, steal Telegram/WhatsApp data, saved passwords, and emails, download more malware, and wipe the computer. Persistence uses a registry Run key (SMQDService or winappx) plus Microsoft Defender exclusions, with stolen data exiting via Telegram and cloud storage services like Vultr and Storj. The US Justice Department seized four pro-Iranian leak sites in March that had published stolen victim data.
65