Threat Intelligence Brief
Curated summary with source attribution
Source: en.bloomingbit.io
Threat Risk: Medium
Victim: Revolut customers
Incident: Data breach via social engineering and spoofed government requests.
Impact: Exposure of passports, IBANs, and Bitcoin transaction histories for targeted users.
Attacker: Unidentified threat actors
Analysis: Attackers successfully impersonated a government entity to bypass Revolut’s internal verification processes. The resulting leak included high-value identity documents and financial records, increasing the risk of targeted phishing and fraud. This incident highlights a critical failure in identity verification for third-party data requests.
Recommendations: Implement multi-channel verification for all official government data requests.; Enhance internal security audits for third-party request validation protocols.; Alert high-net-worth customers to monitor for targeted social engineering attempts.
Source: Bloomingbit
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-09-12 17:41 UTC
Data breach via fraudulent government requests. Exposure of sensitive customer information. Attackers successfully impersonated government officials to trick Revolut employees into releasing sensitive customer data. This highlights a critical failure in identity verification and request validation processes. The breach underscores the ongoing risk of high-level social engineering targeting financial institutions.
Corroborating source: reuters.com
Update — 2026-09-12 17:41 UTC
Data breach via fraudulent government requests. Exposure of sensitive customer personal and financial information. The breach highlights a critical vulnerability in how financial institutions verify high-level third-party requests. Attackers leveraged spoofed government communications to manipulate staff into releasing sensitive customer information. This incident underscores the ongoing efficacy of social engineering against well-resourced organizations.
Corroborating source: marketscreener.com
Update — 2026-09-12 17:41 UTC
Unauthorized disclosure of sensitive customer data via fraudulent government requests. Exposure of PII and identity documents, increasing the risk of identity theft for affected users. Threat actors leveraged a legitimate government email domain to deceive Revolut employees into disclosing customer PII. The breach highlights the risk of trusting email origins without secondary verification, even when the domain appears authentic. The stolen data, including passports and driver’s licenses, provides high utility for identity theft and fraud.
Corroborating source: lse.co.uk
Update — 2026-09-12 18:33 UTC
Customer data leak via a government domain scam. Unauthorized exposure of sensitive customer information. Attackers leveraged deceptive government-themed domains to orchestrate a scam that resulted in the unauthorized exposure of customer data. This incident highlights the effectiveness of authority-based social engineering when targeting financial institutions. The breach demonstrates how trust in official domains can be weaponized for data exfiltration.
Corroborating source: innovation-village.com
Update — 2026-09-12 18:45 UTC
Unauthorized disclosure of PII and financial history via a forged government request. Leak of sensitive identity documents and complete Bitcoin transaction histories for a limited group of users. Attackers leveraged a legitimate government email domain to deceive Revolut into releasing PII and Bitcoin transaction histories. While passwords and funds remained secure, the leaked identity documents and financial logs enable highly targeted phishing and social engineering. The incident underscores the risk of relying solely on email domains for identity verification of regulatory bodies.
Corroborating source: cryptoticker.io
Update — 2026-09-12 19:27 UTC
Data breach triggered by fraudulent government requests. Unauthorized exposure of sensitive customer data. Threat actors successfully impersonated government officials to deceive Revolut into releasing private user data. This incident highlights a critical weakness in the verification processes used for official legal and regulatory requests. It demonstrates how social engineering can bypass technical controls by targeting corporate compliance workflows.
Corroborating source: menafn.com
Update — 2026-09-12 19:27 UTC
Sensitive customer data was leaked after employees fell for a sophisticated impersonation scam. Exposure of passports, driver’s licenses, transaction histories, and IBANs for a limited number of users. This incident highlights a critical failure in data verification processes where a legitimate government email domain was used to deceive employees. By leveraging an authorized domain, attackers bypassed traditional trust filters to request high-value PII and financial records. The breach demonstrates that domain legitimacy does not equal request authenticity.
Corroborating source: cybernews.com
Update — 2026-09-12 21:23 UTC
Exposure of customer passports and transaction records to a fraudulent entity. High risk of identity theft and targeted social engineering attacks. The breach occurred when sensitive data was handed to an unauthorized party impersonating a government agency. While no funds were directly stolen, the exposure of identity documents and financial histories provides attackers with high-value data for identity theft. The lack of a formal post-mortem suggests potential gaps in the company’s incident response transparency.
Corroborating source: intellectia.ai
Update — 2026-09-12 21:23 UTC
Data breach caused by a fraudulent government information request. Potential identity theft and financial loss for high-net-worth users. The incident highlights a critical failure in Revolut’s identity verification protocols for legal requests. Attackers successfully spoofed a government domain to trick employees into disclosing sensitive Bitcoin transaction histories and personal identities. This demonstrates that relying solely on domain appearance for authenticity is insufficient for high-stakes data transfers.
Corroborating source: intellectia.ai
Update — 2026-09-12 21:23 UTC
A data leak exposed the link between Bitcoin wallets and the home addresses of Revolut users. Compromised user anonymity and increased risk of targeted physical or digital attacks. The leak connects cryptocurrency transaction data with personally identifiable information (PII), specifically home addresses. This undermines the perceived privacy of Bitcoin and exposes users to physical and digital risks. Attackers can now target specific high-value wallet holders with precision.
Corroborating source: thestreet.com
Update — 2026-09-12 22:15 UTC
Suspected data leak via a spoofed government request. Exposure of identity documents and Bitcoin transaction histories, increasing risk of fraud and account takeovers. The incident stems from a procedural failure in verifying government data requests rather than a technical exploit. By falling for a social engineering tactic, the company potentially exposed highly sensitive PII and financial records. This highlights a critical weakness in how financial institutions authenticate external legal demands.
Corroborating source: intellectia.ai
Update — 2026-09-13 10:13 UTC
Data breach resulting from a fraudulent government information request. Exposure of sensitive PII, bank details, and cryptocurrency transaction histories. The incident highlights a critical failure in verifying government data requests, allowing attackers to impersonate officials to gain sensitive info. By exploiting this trust, threat actors obtained extensive PII and financial histories. The targeting of wealthy users suggests a calculated effort to identify high-value victims for further exploitation.
Corroborating source: forklog.com
Update — 2026-09-13 10:13 UTC
Unauthorized exposure of customer PII via fraudulent government impersonation. Leak of passports, driver’s licenses, and contact details for high-net-worth individuals. Attackers utilized a legitimate government agency’s email domain to deceive Revolut into releasing sensitive customer information. This indicates a highly targeted social engineering campaign rather than a technical breach of the core banking infrastructure. The theft of passports and driver’s licenses significantly elevates the risk of long-term identity fraud for the affected individuals.
Corroborating source: ynetnews.com
Update — 2026-09-13 17:34 UTC
Large-scale data breach involving the theft of customer identity documents and addresses. Severe risk of identity theft and financial fraud for affected users due to the exposure of passports and licenses. The reported incident involves the exposure of highly sensitive PII, including postal addresses and government-issued identification. This breach emphasizes the vulnerability of KYC (Know Your Customer) archives, which act as high-value targets for attackers. The event suggests that current encryption and access controls are insufficient against sophisticated, AI-enhanced attack vectors.
Corroborating source: linkedin.com
Update — 2026-09-13 19:19 UTC
Unauthorized disclosure of customer data via a government impersonation scam. Exposure of full identity documents, financial transaction history, and cryptocurrency activity. Attackers utilized a compromised government email account to bypass Revolut’s verification processes. This enabled the theft of extensive PII and financial records, specifically targeting high-net-worth crypto users. The incident highlights a critical failure in identity verification when dealing with third-party data requests.
Corroborating source: goosed.ie
Update — 2026-09-13 22:17 UTC
Data breach via a phishing scam using a legitimate government email domain. Limited disclosure of sensitive customer information. The incident demonstrates the high effectiveness of trust-based social engineering, specifically the use of authentic government domains to bypass user suspicion. While Revolut’s internal systems and funds remained secure, the attack targeted the human element to extract data. This highlights a trend where attackers exploit trusted third-party infrastructure to compromise targets.
Corroborating source: bmmagazine.co.uk
Update — 2026-09-14 02:06 UTC
Data breach via external impersonation scam. Exposure of PII, identity documents, and financial transaction history. The breach was executed through a sophisticated impersonation scam where attackers used a legitimate government agency email domain to fraudulently request customer information. The exposure of facial verification images and identity documents creates a severe risk of identity theft and fraudulent account takeovers.
Corroborating source: tradingview.com
Update — 2026-09-14 05:34 UTC
Accidental disclosure of customer data due to a government impersonation scam. Exposure of extensive personal identity documents and detailed financial transaction histories. Attackers successfully impersonated a government agency by utilizing an email account associated with a legitimate government domain. Revolut’s internal verification process failed to identify the request as fraudulent, leading to the disclosure of extensive PII and financial records. This incident underscores a critical vulnerability in how organizations validate high-stakes data requests.
Corroborating source: cybersecurityconnect.com.au
Update — 2026-09-14 11:44 UTC
Data breach caused by the impersonation of a government agency via email spoofing. Exposure of highly sensitive PII, identity documents, and detailed financial transaction histories. The attacker leveraged a spoofed government email domain that bypassed standard authentication checks to request customer data. Revolut’s internal processes failed to verify the legitimacy of these requests through secondary channels. This incident demonstrates that technical email authentication is insufficient for high-stakes data transfers.
Corroborating source: it-connect.tech
Update — 2026-09-14 11:56 UTC
Data breach resulting from a government impersonation scam. Exposure of passports, facial verification images, and full financial transaction histories. The attacker successfully bypassed trust checks by using an authenticated domain to impersonate official government communications. This allowed them to obtain high-value PII, including identity documents and financial records, likely targeting high-net-worth individuals. The incident underscores the danger of relying solely on domain authentication to validate high-sensitivity data requests.
Corroborating source: bleepingcomputer.com
Update — 2026-09-14 14:02 UTC
An unauthorized party gained access to customer data through a phishing attack targeting a Revolut employee. Exposure of high-value identity documents, including passports, driver’s licenses, and verification selfies. The breach occurred when an attacker impersonated a government agency to deceive a Revolut employee. This social engineering tactic allowed the threat actor to access highly sensitive Know Your Customer (KYC) data, including passports and driver’s licenses. While systems and funds remained secure, the leaked identity data significantly increases the risk of synthetic identity fraud for affected users.
Corroborating source: escudodigital.com
Update — 2026-09-14 15:15 UTC
Data breach resulting from a sophisticated impersonation scam using a government email domain. Leak of highly sensitive PII including passports, driving licenses, and verification selfies. Attackers leveraged a legitimate government email domain to deceive Revolut into releasing customer PII. The breach included high-value identity verification data, such as passports and selfies, which significantly increases the risk of synthetic identity fraud. This incident underscores the danger of relying solely on email domains for verifying third-party data requests.
Corroborating source: thejournal.ie
Update — 2026-09-14 16:17 UTC
Data breach via government agency impersonation. Exposure of PII and detailed financial transaction history. Threat actors successfully bypassed verification by impersonating a government agency using authentic domain credentials to request customer data. This breach highlights a critical vulnerability in relying solely on domain-validated emails for high-sensitivity data transfers. The attackers specifically targeted PII and comprehensive financial histories, including cryptocurrency transactions.
Corroborating source: securityweek.com
Update — 2026-09-14 16:17 UTC
Data breach via social engineering using a compromised government email domain. Exposure of PII, including passports, selfies, and financial statements for a limited number of high-net-worth users. Threat actors leveraged a compromised government email domain to manipulate Revolut staff into disclosing sensitive customer data. This targeted approach focused on high-net-worth individuals, bypassing technical security controls by exploiting trust in official channels. The incident underscores the persistent risk of identity impersonation in the financial sector.
Corroborating source: govinfosecurity.com
Update — 2026-09-14 20:07 UTC
Data breach via social engineering and impersonation of a government agency. Mass exposure of sensitive PII, passports, and financial records leading to extortion and fraud risks. Attackers successfully bypassed verification by impersonating a government agency using a legitimate domain to request sensitive customer data. This breach highlights a critical vulnerability in how organizations validate third-party identity and data requests. The exposure of passports and blockchain transaction history creates a high-value target for sophisticated identity theft and fraud.
Corroborating source: disruptionbanking.com
Update — 2026-09-15 05:14 UTC
Exposure of sensitive customer data via a government impersonation scam. Passports, IBANs, and transaction histories of 680 users were leaked to a fraudster. The incident highlights a critical failure in the verification process for legal data requests. By leveraging a government domain to appear legitimate, the attacker manipulated compliance teams into handing over PII without sufficient secondary validation. This underscores that robust technical security is insufficient if the human processes for data egress are flawed.
Corroborating source: shattered.io
Update — 2026-09-15 05:36 UTC
A data breach occurred after fraudsters tricked the company into handing over sensitive customer information. Potential exposure of highly sensitive customer data and significant reputational damage to the fintech provider. Fraudsters successfully employed social engineering tactics to deceive Revolut into disclosing sensitive customer data. This breach highlights critical gaps in internal security controls and employee verification processes. The event underscores how human error remains a primary vector for compromising high-value financial targets.
Corroborating source: sifted.eu
Update — 2026-09-15 12:18 UTC
Data breach via forged government information requests. Leakage of comprehensive KYC data including passports, selfies, and transaction histories for approximately 680 users. The incident highlights a critical vulnerability in how organizations verify official information requests. By spoofing a legitimate government email domain, threat actors tricked Revolut into releasing comprehensive customer profiles. While core systems remained secure, the leakage of identity documents and transaction histories poses a significant long-term risk of identity theft.
Corroborating source: trendingtopics.eu
Update — 2026-09-15 15:56 UTC
Fraudsters used a government email domain to trick Revolut into disclosing sensitive customer identity and financial data. Exposure of passports, selfies, and account histories for roughly 700 customers, followed by extortion attempts. Attackers leveraged a legitimate government email domain to bypass Revolut’s verification processes, tricking staff into releasing sensitive customer PII. This incident underscores the danger of relying on domain-based trust for high-stakes data disclosures. The subsequent ransom demand confirms the attackers’ intent to monetize high-value KYC documents.
Corroborating source: linkedin.com
Update — 2026-09-15 17:19 UTC
Data breach resulting from a sophisticated government email impersonation scam. Exposure of sensitive PII, identity documents, and transaction histories for high-profile customers. Threat actors bypassed security controls by using a legitimate government email domain to impersonate official authorities, tricking the fintech into releasing sensitive PII. This incident demonstrates a critical failure in the verification process for third-party data requests. The subsequent extortion attempt via Telegram underscores the high value placed on high-profile customer data.
Corroborating source: computing.co.uk
Update — 2026-09-15 17:19 UTC
Attackers used a compromised government email account to impersonate officials and request customer data. Exposure of sensitive PII and identity documents for approximately 700 customers, leading to extortion attempts. The breach occurred not through technical exploits, but via a compromised government email account that passed all standard authentication checks. By impersonating officials, attackers convinced Revolut to voluntarily hand over sensitive PII for nearly 700 customers. This underscores the danger of relying solely on domain-level security without behavioral analysis of the request itself.
Corroborating source: cybermagazine.com
Update — 2026-09-15 18:11 UTC
A data breach involving the theft of personal customer information. Increased risk of identity fraud and highly convincing phishing attacks against affected individuals. The breach underscores how attackers leverage authority and urgency to deceive targets into releasing sensitive data. It emphasizes that communications appearing to come from regulators or government agencies must be independently validated. Stolen personal information from such breaches often has a long shelf life, fueling future fraud.
Corroborating source: syncni.com
Update — 2026-09-16 02:06 UTC
Data breach via government impersonation and forged legal orders. Exposure of sensitive PII and ID documents for high-net-worth crypto holders. Attackers utilized advanced email spoofing or compromised government infrastructure to bypass standard technical authentications like SPF, DKIM, and DMARC. By presenting a forged European Investigation Order, they successfully leveraged institutional trust to bypass security protocols. This incident highlights a critical vulnerability where technical email validity is mistaken for identity authenticity.
Corroborating source: capitalbrief.com
Update — 2026-09-16 09:22 UTC
Data breach via fraudulent government email request. Exposure of passport details, bank accounts, and Bitcoin activity for 680 individuals. Attackers successfully deceived Revolut by using a certified PEC email account belonging to an Italian government department. This resulted in the unauthorized disclosure of high-value PII, including passport and banking details, for 680 customers. The breach underscores a critical failure in identity verification for sensitive data requests.
Corroborating source: ansa.it
Update — 2026-09-16 14:12 UTC
A targeted impersonation scam led to the exposure of sensitive customer identity and crypto-asset data. Personal identity documents and bitcoin activity were leaked for approximately 680 customers. Attackers successfully impersonated a government agency using a legitimate domain to trick Revolut into disclosing sensitive customer information. The campaign specifically targeted individuals with significant crypto-asset holdings, indicating a highly focused effort on high-value targets.
Corroborating source: m.economictimes.com
Update — 2026-09-16 21:09 UTC
A $3 million ransom demand following a suspected data breach. Potential exposure of sensitive financial and personal customer data. Threat actors are attempting to extort Revolut by leveraging illegally obtained data. This incident highlights the ongoing risk to financial technology firms that manage massive volumes of sensitive customer information. The scale of the ransom demand suggests a high-value target strategy common among sophisticated extortion groups.
Corroborating source: reuters.com
Update — 2026-09-16 21:09 UTC
Data breach resulting from fraudulent requests sent via a legitimate government email domain. Unauthorized disclosure of sensitive information for approximately 680 customers. The threat actor leveraged a legitimate government email domain to deceive the company into disclosing customer data. This incident highlights a critical vulnerability in verification processes for external requests, even those appearing to come from official sources. While the breach affected a relatively small subset of users, the high ransom demand indicates a targeted extortion attempt.
Corroborating source: channelnewsasia.com
Update — 2026-09-17 10:26 UTC
Alleged customer data breach and ransom demands. Potential exposure of sensitive customer financial and personal information. The incident centers on claims that customer data from Revolut was compromised and used for extortion. While the company denies direct contact regarding ransom demands, the report indicates targeting by extortion-focused actors.
Corroborating source: binance.com
Update — 2026-09-17 20:33 UTC
Data breach and $3 million ransom demand. Potential leak and sale of confidential customer records to other cybercriminals. The group known as ‘iamnotavillain’ claims to have breached Revolut’s systems and is leveraging stolen confidential records for extortion. This event underscores the high-value nature of fintech data and the persistence of double-extortion tactics.
Corroborating source: linkedin.com
Update — 2026-09-18 00:31 UTC
Data breach via compromised government email impersonation. Exposure of 147 GB of identity documents for approximately 680 customers. Attackers leveraged a compromised Italian government email account to trick Revolut into releasing sensitive customer data through fraudulent official requests. This breach highlights a significant weakness in the verification processes for third-party government inquiries. The demand for Monero reflects a calculated move to avoid financial traceability during the extortion phase.
Corroborating source: cryptorank.io
Update — 2026-09-18 06:08 UTC
Data breach via impersonation attack using compromised government email accounts. Leak of customer KYC data, increasing the risk of targeted phishing, extortion, and account takeover for cryptocurrency holders. The attackers utilized a trusted government communication channel to bypass standard security checks, highlighting a critical failure in internal data request verification. By combining leaked KYC data with public blockchain analysis, the threat actors specifically targeted high-value cryptocurrency holders. This incident underscores that email authentication is insufficient for verifying high-risk data disclosures.
Corroborating source: en.oninvest.com
Update — 2026-09-19 15:19 UTC
Targeted phishing campaign leveraging previous data breach information. Potential compromise of user accounts and financial theft. Threat actors are utilizing data from a breach to conduct highly personalized phishing campaigns against Revolut users. By leveraging leaked personal details, attackers increase the credibility of their lures to deceive victims. The primary objective is likely the theft of login credentials and unauthorized fund transfers.
Corroborating source: hackread.com
Update — 2026-09-19 19:08 UTC
Theft of customer records followed by a ransom demand of 6,000 Monero. Exposure of sensitive customer data and high-value financial extortion. Threat actors successfully exfiltrated customer records from Revolut, demanding 6,000 Monero (approximately $3 million) for their return. This incident highlights the strategic use of privacy coins to obscure the financial trail of cyber extortion. The involvement of Italian prosecutors indicates an increasing regulatory focus on the intersection of anonymity-enhanced cryptocurrencies and data theft.
Corroborating source: tradersunion.com
Update — 2026-09-20 00:12 UTC
A data breach occurred after Revolut released customer files to attackers impersonating government officials via a compromised official email domain. Sensitive PII, including passports, financial statements, and crypto activity for roughly 700 users, was exfiltrated and used for extortion. Threat actors compromised a legitimate Italian government email domain to bypass authentication checks and pose as law enforcement. By sending fraudulent information requests, they successfully coerced Revolut into releasing the PII of approximately 700 high-value customers, specifically those with significant cryptocurrency holdings. This incident demonstrates that authenticated official channels can be weaponized to bypass traditional security controls.
Corroborating source: crowdfundinsider.com
Update — 2026-09-21 10:07 UTC
Smishing campaign and data breach involving fraudulent KYC requests. Potential account hijacking, identity theft, and theft of funds, particularly for high-net-worth crypto users. Attackers are using smishing to trick users into visiting fraudulent sites that mimic Revolut’s identity verification process. By requesting camera access for a fake ‘liveness check,’ hackers can steal both passwords and biometric data. This campaign follows a broader breach where attackers compromised Italian government emails to fraudulently request KYC data from the bank.
Corroborating source: infosecurity-magazine.com
Update — 2026-09-21 14:11 UTC
A data breach occurred when Revolut responded to fraudulent data requests sent from a legitimate government email domain. Personal identifiable information, including verification photos and account details for 680 users, was exposed and used for blackmail. The incident stems from a failure to verify the authenticity of legal data requests sent from a compromised or spoofed government email domain. By leveraging the perceived authority of a government agency, the attacker successfully tricked the company into disclosing PII. The subsequent leak of KYC documents and account details has enabled targeted extortion attempts against users.
Corroborating source: lovinmalta.com
Update — 2026-10-01 18:27 UTC
A data breach occurred when attackers used a certified government email system to impersonate officials and request customer data. Unauthorized disclosure of customer data through the exploitation of trust in official communication channels. Attackers bypassed technical security controls by using Italy’s certified email system (PEC) to send fraudulent data requests. Because the messages were routed through a genuine, authenticated government channel, standard DMARC and email filters failed to flag them. This case highlights the critical gap between technical domain authentication and actual sender trustworthiness.
Corroborating source: right-hand.ai