Revolut has disclosed a data breach after sending sensitive customer information to an attacker impersonating a government agency. The exposed records include identity documents, facial verification images, account statements and complete transaction histories.
The fintech company said the incident affected a very limited number of customers. However, it has not revealed the exact figure.
Attacker Used Official Government Email Domain
The incident began when Revolut received an email requesting customer information. The message appeared to come from a legitimate government organisation.
According to the company, an unauthorised account sent the request directly through the agency’s official email domain. The message also carried valid domain authentication credentials.
Consequently, Revolut believed the request was genuine and provided the requested customer information. The company did not identify the government agency involved or explain how the attacker gained access to its email system.
Revolut operates across more than 160 countries and regions. It provides banking, investment and money management services to over 80 million customers, including 800,000 business clients.
Breach Exposes Identity Documents and Selfies
The Revolut data breach exposed several types of personally identifiable information. The shared records included customers’ full names, dates of birth and occupations.
Attackers also received postal addresses, email addresses and telephone numbers. In addition, the compromised data contained copies of passports or driving licences.
Revolut also disclosed facial verification images submitted during Know Your Customer checks. Customers typically provide these selfies when creating and verifying an account.
This combination creates a significant identity theft and impersonation risk. Criminals could also use the information to create convincing phishing messages aimed at affected customers.
Financial and Bitcoin Records Included
The exposed information extended beyond identity and contact details. Revolut shared account statements containing International Bank Account Numbers, as well as withdrawal records.
Moreover, the breach exposed complete transaction histories. These records included customers’ Bitcoin transactions.
Revolut said its internal systems and customer funds remained unaffected. Therefore, the incident did not result from attackers directly breaching the company’s banking platform.
However, the detailed financial records could help criminals identify high-value targets. Crypto fraud investigator ZachXBT suggested that the attacker may have specifically targeted wealthy Revolut users.
Revolut Notifies Authorities and Regulators
Revolut blocked the unauthorised email address after discovering the incident. It also notified the affected government agency and relevant law enforcement bodies.
Additionally, the company informed data protection authorities and financial regulators. Revolut has started contacting customers whose information appeared in the disclosed records.
The company described the number of affected users as very limited. Nevertheless, it declined to provide a precise total.
Affected customers should remain alert for targeted phishing, identity fraud and account impersonation attempts. They should also treat messages containing accurate personal or financial details with caution.
Previous Breach Affected Over 50,000 Customers
The incident follows another Revolut data breach disclosed in September 2022. In that case, attackers stole personal, contact and financial information belonging to 50,150 customers.
The stolen data later fuelled a wave of phishing attempts. Similarly, criminals could use information from the latest breach to make fraudulent messages appear legitimate.
Revolut customers affected by the new incident should monitor their accounts and verify unusual requests through official support channels. They should also avoid sharing verification codes or credentials in response to unexpected messages.
0 responses to “Revolut Data Breach Exposes Passports and Financial Records”