Revolut Says Impersonator Obtained Sensitive Customer Records
Summary
Revolut said an impersonator using an email address on a government agency’s domain obtained records from a limited number of customers. The company blocked the sender, notified authorities and said its systems and customer funds were unaffected.
Key points
- An impersonator used an email address on a government agency’s domain to obtain Revolut customer records.
- The company said a limited number of customers were affected and contacted them directly.
- Records listed in customer notifications included birth dates, contact details and copies of identity documents.
- Revolut said verification selfies, account statements and transaction histories may also have been exposed.
- Crypto investigator ZachXBT said IBANs, withdrawal records, occupations and bitcoin transaction history were also involved, and suggested high-net-worth users may have been targeted.
- Revolut said it blocked the sender and notified the agency, law enforcement, data protection authorities and financial regulators; it said its systems and customer funds were unaffected.
Article Details
- Victim Organization
- Revolut
- Incident Type
- External impersonation scam that led to unauthorized disclosure of customer records
- Data Types Exposed
- Birth dates
- Postal addresses
- Email addresses
- Phone numbers
- Copies of identity documents, including passports and driving licences
- Verification selfies, account statements, and transaction histories may also have been exposed
- IBANs, withdrawal records, occupations, and bitcoin transaction history were reported by ZachXBT
- Affected Records
- A limited number of customers; exact count not disclosed
- Operational Impact
- Revolut blocked the sender and notified relevant authorities. The company said its systems and customer funds were not affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed