Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency.
Revolut operates in over 160 countries and regions and offers banking, money management, and investment services to more than 80 million customers worldwide, including 800,000 business customers.
In emails sent to affected customers, the company said that the attacker requested the personally identifiable information (PII) via email using a government agency’s domain.
“Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency’s email domain,” it told affected customers. “As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request.”
Revolut says that the data sent to the threat actors includes affected individuals’ identity details (i.e., full name, date of birth, occupation), contact details (postal address, email address, and telephone number), as well as document and verification data such as copies of your identity documents (passport and/or driver’s license) and facial verification images (selfies provided for Know Your Client verification when opening an account).
The exposed information also includes account statements (including IBAN numbers), withdrawal records, and full transaction history (including Bitcoin transactions).
The company told Reuters that the resulting data breach affects a “very limited” number of customers, but has refused to share an exact number.
“Revolut systems and customer funds are unaffected. Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators,” a Revolut spokesperson said.
Crypto fraud investigator ZachXBT said over the weekend that while the breach likely affects a limited number of Revolut customers, “it seems to have been targeted at high net worth users.”
A Revolut spokesperson was not immediately available for comment when BleepingComputer reached out for more details about the incident.
Four years ago, Revolut disclosed another data breach after attackers stole the personal, contact, and financial information of 50,150 customers in September 2022.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
