Revolut Data Breach: Infostealers Exploit Social Engineering Tactics

• •Revolut's customer data breach involved unauthorized access to sensitive information.
• •The attack employed infostealers and social engineering tactics over five months.
• •Revolut has notified authorities and is investigating the incident's impact.

Revolut confirmed that unauthorized third parties accessed sensitive customer data, including passports and driving licenses, through fraudulent requests sent from a legitimate government email domain. The attack was executed using infostealers to compromise employee email accounts, allowing the hacker to send fake requests to Revolut's Lithuanian subsidiary. Over a five-month period, the hacker maintained control of the compromised inbox, sending multiple fraudulent requests without raising suspicion. Revolut has alerted relevant authorities and is assessing the impact on its 80 million global customers. The incident highlights the critical distinction between verifying information and authenticating the identity behind requests, emphasizing the risks of social engineering attacks.