Skip to content
OriginalSign in

DataBreachesDissent

Revolut Reportedly Shared Biometric Data After Fake Government Request

Part of the Revolut story · since 6 Sep

Quiet for 6 weekslast report 21 Sep13 articles6 outlets
6 Sep · DataBreaches first6 Oct16 OctNowThis article8th of 13
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request. This article, 8th of 13.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.

Revolut was reportedly involved in a data incident in which someone requested customer information using what appeared to be a genuine government email address. The fintech supplied the data, although the report says there was no conventional hacking, malware infection or unauthorised access to its systems.

The incident involved a large volume of identity and biometric information, according to the supplied report, but it does not provide further details about the number of affected customers, the precise data disclosed or how the request was identified as fraudulent.

The case highlights a potential gap in cyber-insurance policies. Social-engineering cover commonly focuses on fraudulent instructions that result in money being transferred, while crime policies are generally designed around financial loss and data-breach policies may assume unauthorised system access. A convincing but fraudulent request that causes sensitive data to be disclosed, without any payment or system compromise, may therefore fall between those categories.

The report says brokers are reviewing wording for fintech and financial-services clients, including whether definitions of “fraudulent instruction” cover requests for information as well as payment instructions.

How the story developed

All 13 articles
Quiet for 6 weekslast report 21 Sep13 articles6 outlets

13 articles from 6 outlets since 6 Sep. Quiet since 21 Sep. This was the 8th report, 9 days after the first.

Now6 Sep910121416182022First reportDataBreaches · 6 Sep, 11:46This article8th of 13 · day 9Picked up againafter 6 days quiet
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request. This article, 8th of 13.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Sun 6 SepDay 01
    1. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks11:46 · DataBreaches · First report

  2. Quiet for 6 days

    Sat 12 SepDay 61
    1. Revolut Exposed Customer Data After Fraudulent Government Request21:57 · Security Affairs · Picked up again
  3. Mon 14 SepDay 84
    1. Revolut Exposed Customer Data After Fraudulent Government Requests09:36 · SecurityOnline
    2. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests11:57 · Infosecurity
    3. Revolut Exposed Customer Data After Government Email Scam11:57 · Malwarebytes
    4. Revolut Exposes Customer Data After Impersonated Agency Request13:41 · SecurityWeek
  4. Tue 15 SepDay 92
    1. Revolut Confirms Data Breach After Government Email Impersonation12:00 · DataBreaches
    2. Revolut Reportedly Shared Biometric Data After Fake Government Request12:35 · DataBreaches · This article, 8th of 13
  5. Wed 16 SepDay 101
    1. Italian Government Email Hack Exposes Data on 680 Revolut Users14:16 · Security Affairs
  6. Thu 17 SepDay 112
    1. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data14:11 · SecurityWeek
    2. Revolut Customers Targeted by Phishing Days After Data Breach14:48 · Malwarebytes

  7. Quiet for 4 days

    Mon 21 SepDay 152
    1. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs07:30 · Malwarebytes · Picked up again
    2. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks09:13 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in