Revolut disclosed sensitive customer information to an unauthorized third party after fraudulent data requests were sent from an email address hosted on a legitimate government agency domain, the fintech confirmed on September 12.
The incident was not described as a breach of Revolut’s own systems. Instead, the attacker exploited the credibility of an official domain to impersonate a government authority and obtain customer records. Revolut said a “very limited” number of customers were affected but has not disclosed an exact figure, identified the government agency involved or said whether the incident was confined to one country.
Notifications sent to affected customers indicate that exposed information could include names, dates of birth, postal and email addresses, phone numbers, passports or driving licences and verification photographs. Depending on the customer, account statements, IBANs, withdrawal records and transaction histories (including Bitcoin transactions) may also have been disclosed.
Revolut said its systems and customer funds were unaffected. After detecting the fraudulent requests, the company blocked the address and alerted the government agency concerned, law enforcement, data-protection authorities and financial regulators. Affected customers were contacted directly.
The incident highlights a security problem beyond conventional phishing: an apparently authentic email domain can establish where a message originated without proving that the person operating the account is authorized to request sensitive financial data.
[…] attackers claim they compromised an Italian government email system and spent several months impersonating law-enforcement officials. Requests for specific Revolut […]