Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Revolut Exposes Customer Data After Impersonated Agency Request

Part of the Revolut story · since 6 Sep

Quiet for 5 weekslast report 21 Sep13 articles6 outlets
6 Sep · DataBreaches first3 Oct12 Oct21 OctNowThis article6th of 13
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request. This article, 6th of 13.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.

Revolut is notifying a small, unspecified number of users that their personal and financial information was exposed after an unauthorised party impersonated a government agency. The London-based fintech, which provides banking and investment services to more than 80 million users across 160 countries and regions, said the fraudulent request arrived from a legitimate government-agency domain and carried valid technical credentials.

It was therefore handled as an authentic legal inquiry, as financial institutions are required to comply with genuine requests from law-enforcement and government bodies.

According to emails sent to affected customers, the exposed information included names, addresses, telephone numbers, email addresses, dates of birth, occupations, copies of driving licences and passports, and verification selfies. Financial data, including IBANs, account statements, withdrawal records and complete transaction histories, including Bitcoin transactions, was also disclosed. Revolut confirmed the incident to SecurityWeek, describing it as a “sophisticated external impersonation scam”.

The company said it blocked the attacker’s email address after discovering the breach and notified the relevant government agency, law-enforcement bodies, data-protection authorities and financial regulators. Revolut said its systems and customer funds were unaffected, and that it had contacted the limited number of impacted users directly to provide support.

How the story developed

All 13 articles
Quiet for 5 weekslast report 21 Sep13 articles6 outlets

13 articles from 6 outlets since 6 Sep. Quiet since 21 Sep. This was the 6th report, 8 days after the first.

Now6 Sep910121416182022First reportDataBreaches · 6 Sep, 11:46This article6th of 13 · day 8Picked up againafter 6 days quiet
  • Sun 6 Sep, 11:46 UTC. DataBreaches, first report. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks.
  • Sat 12 Sep, 21:57 UTC. Security Affairs, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Request.
  • Mon 14 Sep, 09:36 UTC. SecurityOnline, its first report on the story. Revolut Exposed Customer Data After Fraudulent Government Requests.
  • Mon 14 Sep, 11:57 UTC. Infosecurity, its first report on the story. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests.
  • Mon 14 Sep, 11:57 UTC. Malwarebytes, its first report on the story. Revolut Exposed Customer Data After Government Email Scam.
  • Mon 14 Sep, 13:41 UTC. SecurityWeek, its first report on the story. Revolut Exposes Customer Data After Impersonated Agency Request. This article, 6th of 13.
  • Tue 15 Sep, 12:00 UTC. DataBreaches. Revolut Confirms Data Breach After Government Email Impersonation.
  • Tue 15 Sep, 12:35 UTC. DataBreaches. Revolut Reportedly Shared Biometric Data After Fake Government Request.
  • Wed 16 Sep, 14:16 UTC. Security Affairs. Italian Government Email Hack Exposes Data on 680 Revolut Users.
  • Thu 17 Sep, 14:11 UTC. SecurityWeek. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data.
  • Thu 17 Sep, 14:48 UTC. Malwarebytes. Revolut Customers Targeted by Phishing Days After Data Breach.
  • Mon 21 Sep, 07:30 UTC. Malwarebytes. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs.
  • Mon 21 Sep, 09:13 UTC. Infosecurity. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Sun 6 SepDay 01
    1. US Offers $10m Reward for Iranian Cyber Chief Behind Attacks11:46 · DataBreaches · First report

  2. Quiet for 6 days

    Sat 12 SepDay 61
    1. Revolut Exposed Customer Data After Fraudulent Government Request21:57 · Security Affairs · Picked up again
  3. Mon 14 SepDay 84
    1. Revolut Exposed Customer Data After Fraudulent Government Requests09:36 · SecurityOnline
    2. Revolut Data Breach Exposes Customer IDs in Fake Agency Requests11:57 · Infosecurity
    3. Revolut Exposed Customer Data After Government Email Scam11:57 · Malwarebytes
    4. Revolut Exposes Customer Data After Impersonated Agency Request13:41 · SecurityWeek · This article, 6th of 13
  4. Tue 15 SepDay 92
    1. Revolut Confirms Data Breach After Government Email Impersonation12:00 · DataBreaches
    2. Revolut Reportedly Shared Biometric Data After Fake Government Request12:35 · DataBreaches
  5. Wed 16 SepDay 101
    1. Italian Government Email Hack Exposes Data on 680 Revolut Users14:16 · Security Affairs
  6. Thu 17 SepDay 112
    1. Hackers Demand $3 Million After Fraudulent Requests Expose Revolut Data14:11 · SecurityWeek
    2. Revolut Customers Targeted by Phishing Days After Data Breach14:48 · Malwarebytes

  7. Quiet for 4 days

    Mon 21 SepDay 152
    1. Android RatHat Malware Steals Bank Logins and Screen-Lock PINs07:30 · Malwarebytes · Picked up again
    2. Revolut Breach Fuels Smishing Attacks Using Fake Identity Checks09:13 · Infosecurity

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in