Revolut data leak: Hackers use genuine government domain for theft

The neobank Revolut is facing a data breach. Perpetrators used a genuine government domain to obtain sensitive information.

Europe’s largest neobank is currently aiming to cross the pond. Revolut is also seeking a banking license in the USA. It is extremely inconvenient that the neobank now has to deal with a data protection incident. In the hack, wealthy individuals were apparently specifically targeted.

The neobank has already admitted to being the target of a “sophisticated external fraud attempt” in which sensitive customer data was leaked. An unauthorized third party used a legitimate government agency’s email domain to submit fraudulent information requests.

Financial institutions are legally obliged to comply with official requests from law enforcement or government agencies. Since the email in this case came from a verified government domain, Revolut processed the requests accordingly and forwarded the requested data.

The fraud was only discovered through a later inquiry by the bank to the agency. It is not known which regulatory authority the fraudulent email came from. Revolut provides no information on this. It is also unclear whether other banks or fintechs have received similar emails.

However, Revolut’s IT systems and customer funds are not affected by the hacker attack, the fintech emphasizes. After the discovery, Revolut immediately blocked the relevant address and reported the incident to the responsible government agencies and law enforcement authorities. But by then, the attackers had apparently already obtained some data.

A few hundred customers are likely affected, a small number also in Germany; they were contacted directly by Revolut. The data handed over included identity and details such as date of birth, postal and email addresses, phone numbers, and transaction data, including Bitcoin transactions. In addition, copies of identity documents such as passports and driver’s licenses were passed on.

According to TechCrunch, crypto security researcher ZachXBT reported on the evening of September 11, 2024, on Revolut’s email to the affected customers. He suspected that wealthy individuals were primarily targeted in the attack.

Meanwhile, the hackers have apparently launched an extortion attempt and, according to the analysis service International Cyber Digest, have published, among other things, identity documents and selfies of tennis player Alexander Shevchenko and Felix Römer, CEO of the online crypto casino Gamdom, in a Telegram group. Further publications are said to follow if Revolut does not pay. It has not yet been verified whether the hackers are actually behind the extortion attempt and whether the published documents are genuine.

Römer himself writes in an X post that he and other customers had already been blackmailed with the compromised data two months ago. According to the bank, more than 80 million customers in over 30 countries worldwide trust Revolut’s services. Most recently, the neobank expanded its presence in India, Mexico, and the United Arab Emirates, among others.

At the beginning of September, Revolut also received restricted approval from the US banking supervisory authority. The goal is to establish a bank in the USA in the first half of year.

This article first appeared on t3n.de .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.