Customers of the neobank Revolut have been targeted by cybercriminals after attackers managed to acquire sensitive customer data using a legitimate government email address. Several hundred individuals worldwide are affected, including a small number of customers in Germany. According to the financial institution, neither internal IT systems nor customer funds were directly compromised.
Espionage via Fake Government Inquiries
The attackers used a legitimate email domain belonging to a government agency to send official requests for information to Revolut. Because financial institutions are legally obligated to cooperate with law enforcement and regulatory authorities, the neobank processed the seemingly authentic requests and released the demanded information. The deception was only uncovered following a subsequent inquiry with the agency in question. Revolut did not specify which authority was involved.
Through this scheme, the perpetrators obtained extensive personal records, including:
- Full contact details, dates of birth, postal and email addresses, and phone numbers
- Copies of identity documents, such as passports and driver’s licenses
- Transaction records, including completed Bitcoin transfers
Once the breach was discovered, Revolut promptly blocked the abused email address and alerted regulatory and law enforcement authorities.
Targeted Extortion Attempts Against Victims
Initial findings suggest that the attack primarily targeted high-net-worth individuals. Stolen identity documents and selfies have reportedly already surfaced in Telegram groups to exert pressure on both the neobank and individual customers. One affected entrepreneur stated that they had already been blackmailed with the stolen data months ago.
The incident hits the company during a delicate expansion phase. Revolut counts more than 80 million customers worldwide and is currently pursuing a full banking license in the United States, following a restricted authorization granted in early September.
What Affected Customers Need to Know
Revolut has already notified all directly affected customers via email. Those who have not received a notification are currently not believed to be part of the compromised group. Nevertheless, heightened vigilance is advised for all users:
- Scrutinize suspicious communications: Armed with authentic passport copies or transaction details, scammers can make follow-up attacks (such as spear phishing) appear remarkably convincing. Calls or messages claiming to come from banks or authorities should always be treated with skepticism.
- Do not pay ransoms: If extortionists make contact and threaten to publish personal documents, victims should immediately contact the police and refrain from complying with monetary demands under any circumstances.
- Keep two-factor authentication enabled: Because phone numbers and addresses were also compromised, security-critical accounts should be further protected using authenticator apps.
Further details on the background of the incident can be found in the report by Heise Online.
Quellen: Heise – News
