Revolut Exposed Customer Data After Falling for Impersonation Scam

Revolut has confirmed that it sent sensitive personal and banking data of a limited number of customers to an unauthorized third party. The company stated that it fell victim to a sophisticated external impersonation scam in which the attacker used an email address with a legitimate government agency domain to submit fraudulent requests for information. Upon discovering the breach, Revolut blocked the email address and notified law enforcement, data protection authorities, and financial regulators. The bank maintains that its internal systems and customer funds were not affected.

While Revolut did not specify the exact number of affected clients or the specific types of data leaked, cybersecurity researcher ZachXBT reported that the exposed information includes know your customer data. This reportedly consists of full names, dates of birth, home addresses, email addresses, phone numbers, occupations, and copies of passports or driver licenses, along with verification selfies. Banking details such as IBANs, account statements, withdrawal records, and full transaction histories, including Bitcoin transactions, were also allegedly compromised. ZachXBT noted that the attack appeared to target wealthy users, while The Register reported that snippets of data belonging to high profile individuals, including CEOs and sports professionals, have appeared in Telegram groups.

According to The Register, individuals claiming responsibility for the attack are demanding a ransom of 10,000 Bitcoin, which is valued at over 782 million dollars, and are threatening to release more data daily. Revolut has not commented on these ransom demands. The company, which recently obtained a banking license in France and approval for its UK bank, serves over 80 million personal customers globally.