Digital bank Revolut inadvertently disclosed sensitive customer data to an unauthorized third party, which posed as a legitimate government agency. The scammers utilized a genuine government email domain to make fraudulent requests for information, tricking Revolut into complying with what appeared to be mandatory legal demands under GDPR. The exposed data includes highly sensitive information such as identity documents (passports, driver's licenses), verification selfies, full names, dates of birth, home and email addresses, phone numbers, occupations, account statements, IBANs, withdrawal records, and complete transaction histories, including Bitcoin transactions.
While Revolut has not officially confirmed the number of affected customers, sources close to the company indicate that only a "small proportion" of its over 80 million global customers were impacted, with some estimates putting the number at around 700 individuals. Following the detection of the breach, Revolut immediately blocked the fraudulent address and informed relevant government agencies, enforcement agencies, data protection authorities, and financial regulators. The company maintains that its core systems and customer funds remain unaffected and has directly contacted the affected individuals to provide support.
Adding to the crisis, a hacker group, identified as Revolut Smilik, is threatening to release more data daily unless Revolut pays a ransom of 10,000 Bitcoin, equivalent to more than $782 million. The hackers claim to have already released data of several notable figures, including Mark Karpelès, former CEO of Mt. Gox. The incident raises significant concerns about Revolut's security controls, especially as the company, valued at an estimated $115 billion in a recent share sale and eyeing a $200 billion valuation for a potential IPO by 2028, accelerates its global expansion plans. One customer, Felix Römer, reportedly received blackmail threats two months before Revolut notified users of the breach, suggesting the attackers had access for an extended period.
