Revolut Confirms Data Breach After Government Agency Impersonation
Summary
Revolut confirmed that an unauthorized party used a legitimate government agency email domain to request customer information, exposing personal and financial data for an undisclosed number of users.
Key points
- The attacker posed as a government agency and used a legitimate agency email domain to submit fraudulent information requests.
- Exposed personal data included contact details, dates of birth, occupations, identity-document copies, and verification selfies.
- Financial data exposed included IBANs, account statements, withdrawal records, and transaction histories, including Bitcoin transactions.
- Revolut said only a subset of users was affected but did not disclose how many.
- The company said it blocked the email address, notified relevant government and enforcement agencies, data-protection authorities, and financial regulators, and contacted affected users.
- Revolut said its systems and customer funds were unaffected.
Article Details
- Victim Organization
- Revolut
- Incident Type
- Data breach involving fraudulent information requests by an unauthorized third party impersonating a government agency
- Data Types Exposed
- Names
- Addresses
- Phone numbers
- Email addresses
- Dates of birth
- Occupations
- Copies of driver’s licenses and passports
- Verification selfies
- IBANs
- Account statements
- Withdrawal records
- Full transaction history, including Bitcoin
- Affected Records
- A subset of users; the number of individuals affected was not disclosed.
- Operational Impact
- Revolut said its systems and customer funds were unaffected. It blocked the attackers’ email address and contacted affected users.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed