Hackers posing as government officials steal 680 Revolut customer's account data

Financial technology firm Revolut has notified approximately 680 customers following a personal data breach in which staff mistakenly transferred sensitive personal records to cyber criminals posing as government officials.

The incident occurred after a threat actor obtained a legitimate government agency domain email address to lodge fraudulent requests for account data. Revolut complied with the submission, releasing passport details, identity cards, residential addresses, bank account numbers, verification photographs, and bitcoin transaction records. The perpetrators subsequently threatened to publish the exfiltrated records unless a ransom payment was made.

Revolut stated that it identified the sophisticated impersonation scam, immediately blocked the offending address, and confirmed that internal systems and customer funds remained unaffected. Revolut declined to comment formally on the number of affected users, though it self-reported the breach to the Information Commissioner's Office (ICO). The regulator confirmed that it has opened an investigation into the security failure.

£ - This article requires a subscription.

A version of this article is available without subscription in City AM.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.