- Revolut fell for a spoofed government email scam, leaking sensitive customer data to attackers
- Compromised info includes IDs, selfies, account statements, IBANs, and full transaction histories
- Criminals now allegedly leaking data on Telegram, demanding 10,000 BTC (~$780M) ransom from Revolut
Digital banking platform Revolut was tricked into giving away a treasure trove of sensitive customer data to hackers, and it is now coming back to bite it.
The company told TechCrunch that it recently fell victim to a “sophisticated external impersonation scam” in which the threat actor “utilized a legitimate government agency domain email to submit fraudulent requests for information”.
In other words, the attackers either broke into, or spoofed, an email address belonging to the police, tax authorities, or other government bodies with statutory powers to demand information, and used them to demand Revolut hand over sensitive customer data.
Demanding ransom
Cybernewsreports that the compromised data includes customers’ birth dates, postal and email addresses, occupation, phone numbers, and copies of identity documents. TechCrunch added that verification selfies, account statements, and transaction histories may have also been compromised, together with IBANs, withdrawal records, complete transaction histories, and Bitcoin transactions.
Should these reports be confirmed, this will be a bonafide fiasco for Revolut.
“Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators,” a company spokesperson told Reutersover the weekend.
So far, we don’t know exactly how many people are affected. Revolut said it is a “very limited” number, and that all of them had been notified already.
According to Coin Bureau, the criminals have started leaking sensitive data on Telegram, in a bid to pressure Revolut into paying a ransom demand. The publication shared screenshots of the threat actors apparently leaking a selfie and “full KYC” of a CEO of a crypto casino website, saying that the crooks are now demanding 10,000 BTC in exchange for deleting the data.
This would put the ransom demand at approximately $780 million which is obscene even by criminal standards.
“This one is deeply concerning and the implications for affected customers go well beyond a standard data breach notification,” said Muhammad Yahya Patel, vCISO & Cybersecurity Advisor at Huntress. “Passports, driver’s licenses, verification selfies, account statements, transaction histories, birth dates, addresses that’s not a data leak, that’s a complete identity theft kit handed to whoever sent those fraudulent requests.”
“Every single component needed to impersonate someone, open accounts in their name, or bypass checks at other financial institutions is in that package. On the dark web, that kind of profile doesn’t sell as individual records it sells as a ready-made fraud pack, and it commands a significant premium precisely because of its completeness.”
“For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high. The question isn’t why an attacker tried this. It’s why a regulated financial institution handling highly sensitive data didn’t have sufficiently rigorous verification controls to catch it,” Patel concluded.
