Revolut Breach: Attackers Used a Fake Government Email to Walk Off With Passports, Selfies, and Bank Records
No malware. No brute-force attack. No breached server. Just one email that looked official enough to be believed.
Revolut has disclosed that attackers impersonating a government agency convinced staff to hand over sensitive customer data — by sending a request from an email address carrying valid government-domain authentication credentials. That single detail is what makes this breach worth paying attention to.
What was exposed:
→ Names, dates of birth, occupations, phone numbers, and addresses
→ Passport and driver's-license copies
→ Facial-verification selfies
→ IBAN numbers, account statements, and withdrawal records
→ Full transaction histories, including some Bitcoin transactions
Revolut says its internal systems and customer funds were not compromised, and only a limited number of its 80+ million customers across 160+ countries were affected. But "limited" is relative at Revolut's scale — and the nature of what leaked (government ID documents plus a live selfie plus your banking history) is close to a complete identity-theft starter kit for whoever it touched.
Here's the part that should worry every security team, not just fintechs: this wasn't a technical failure. Revolut's defenses reportedly held. What failed was trust in a communication channel — an email that looked like it came from a real government agency, sent to a process built to comply with real government requests. You can encrypt every database you own and still lose this exact fight, because the attacker isn't breaking in. They're being let in, politely, by someone doing their job correctly by every visible signal.
That's the direction attacks on well-defended companies are heading — not smashing through the front door, but forging the paperwork that gets someone to open it for them.
If your organization handles ID verification or responds to "official" requests, does your process actually verify the requester — or just the format of the request?
#DataBreach #Cybersecurity #Fintech #Revolut #InfoSec #DataPrivacy
— 𝔖𝔞𝔫𝔡𝔢𝔢𝔭 ℜ𝔞𝔦𝔷𝔞