Threat Intelligence Brief
Curated summary with source attribution
Source: coinmarketcap.com
Threat Risk: High
Victim: Revolut customers
Incident: Unauthorized disclosure of customer PII and transaction history due to a social engineering attack.
Impact: Exposure of passports, selfies, and Bitcoin histories, increasing the risk of identity theft and targeted attacks.
Attacker: Unidentified threat actors
Analysis: The attacker leveraged a legitimate government email domain to bypass Revolut’s verification processes. This highlights a critical failure in the authentication of official data requests. The resulting leak of KYC data and transaction history creates significant privacy and security risks for the targeted users.
Recommendations: Strengthen verification protocols for all third-party and government data requests; Implement multi-step internal approvals for the export of sensitive customer PII; Advise high-value users to increase monitoring for targeted phishing and physical security threats
Source: CoinMarketCap
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-09-14 22:12 UTC
Personal data of approximately 700 customers was exposed to scammers. Increased risk of targeted phishing and financial fraud for affected users. Revolut reportedly mishandled personal information, resulting in nearly 700 customers’ data being leaked to malicious actors. This incident highlights the ongoing risk of data mismanagement within the high-growth fintech sector.
Corroborating source: ft.com