Revolut Says Fraudulent Government-Email Requests Exposed Customer Data
Summary
Revolut says fraudsters used an email from a government agency’s domain and valid credentials to obtain data on a limited number of customers, including identity documents and Bitcoin transaction records.
Key points
- Revolut says a third party submitted fraudulent information requests using an email from an official government agency domain and valid credentials.
- Customer notifications reportedly listed passports, driving licences, home addresses, bank statements, verification selfies and Bitcoin transaction records among the data sent.
- Revolut said login credentials, secret codes, biometric face data and customer funds were not affected, and no money was moved.
- The company said it blocked the sender after detecting the issue and notified the relevant agency, police and regulators.
- Revolut said it contacted a limited number of affected customers; the article does not establish whether a government mailbox was compromised or an authorized user sent the requests.
- Blockchain investigator ZachXBT reported the exposure and said it affected a small group of users.
Article Details
- Victim Organization
- Revolut
- Incident Type
- Cyberattack involving impersonation and fraudulent information requests, resulting in unauthorized disclosure of customer data.
- Data Types Exposed
- Passport information
- Verification selfies
- Bitcoin transaction records
- Driver's license information
- Home addresses
- Bank statements
- Affected Records
- A limited number of customers; no exact count disclosed.
- Operational Impact
- Revolut said its systems and customer funds were unaffected, and that no money was moved. It said it blocked the sender after detecting the issue and notified the relevant agency, police, and regulators.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed