Revolut Data Breach: What Happened and What Should Customers Do?

What happened?

On 12 September, Revolut said an impersonation scam had led it to share customer data with an unauthorised third party. The attacker used the email domain of a legitimate government agency to submit fake information requests. The requests passed authentication checks, so staff handled them as routine legal-compliance requests. Revolut said its systems and customer funds were not compromised.

Who may be affected?

The Financial Times reports that around 680 customers across several European countries were affected, although Revolut has not publicly confirmed that number. Reported exposed data included addresses, verification photos, identity documents, banking activity and bitcoin holdings. The affected records appear to be concentrated among customers suspected of holding cryptocurrency.

What remains disputed?

The Financial Times reports that a group calling itself iamnotavillain demanded $3 million and threatened to sell the data. Revolut told Reuters it has had no contact with the group and has received no ransom demand. TheICOhas confirmed it received a report and is assessing it.

What should Revolut customers do?

• Verify any contact. Expect phishing and extortion attempts. Check messages through the official Revolut app rather than following links in messages.
• Do not pay. Payment does not guarantee that data will be deleted. Report approaches toReport Fraud, formerly Action Fraud.
• Protect your identity. If identity documents may have been exposed, consider Cifas Protective Registration and check your credit reports.
• Lock down your accounts. Use unique passwords, app-based two-factor authentication and transaction alerts. Crypto holders should be especially cautious about unsolicited support contacts.

Five cybersecurity lessons businesses can learn

Revolut's systems were not hacked in this incident. Staff were deceived into disclosing data, making this a useful case study for any small or medium-sized business.

1. A genuine domain is not proof of a genuine sender.The requests reportedly came from a real government email domain and passed authentication checks. A compromised account can pass them too.
2. Verify high-risk requests another way.Confirm requests for data or payment changes using a phone number sourced independently, never a number supplied in the email.
3. Add friction where the stakes are high.Require a second approver before disclosing personal data, and empower staff to pause and escalate unusual requests.
4. Hold less data. Delete information you no longer need and restrict access to the data you must retain, especially identity documents.
5. Plan your response in advance.Serious personal data breaches generally need to be reported to theICO within 72 hours. Decide who leads the response, who communicates with customers and when to contact law enforcement. Report fraud and extortion attempts toReport Fraud, and do not rush into paying a ransom.