Revolut customers received direct notification on Friday regarding a privacy breach. The company accidentally handed over a batch of sensitive user data to scammers. The leaked documents include passport copies, selfie photos used for identity verification, and complete transaction history records.
The attacker sent a data request using a legitimate government agency email domain to bypass the company’s defenses. This official address allowed the attacker’s message to pass Revolut’s internal authentication checks. The company only determined that the data request was fraudulent after all the documents had already been handed over.
A Revolut spokesperson described the incident as a sophisticated external impersonation scam. An unauthorized third party abused a genuine government agency email domain to facilitate their operation to obtain customer data.
Who Was Targeted by the Attackers
On-chain investigator ZachXBT assessed that the incident was limited in scale and specifically targeted high-earning or high-net-worth customers. Although user identities fell into the hands of hackers, Revolut confirmed that all internal systems and customer funds remained completely unaffected by this breach.
Once the scam was detected, the company blocked the fraudulent email address from its network. Revolut also promptly notified the government agency whose name was spoofed, while forwarding reports to relevant law enforcement agencies and financial regulators.
New details update the picture from earlier preliminary reports. Initial news had only highlighted the leak of user Bitcoin transaction histories, but it is now confirmed that the privacy fallout goes much deeper, compromising passports and facial photos.
Criticism of KYC Rules
The string of leaked documents sparked debate on platform X regarding mandatory verification or KYC systems. Marc Zeller voiced sharp criticism, stating that KYC enforcement provides little meaningful benefit and instead poses greater danger to the public through centralized data storage.
While cryptocurrency balances remained protected within the system, compromised government documents pose a different challenge. Monetary losses might be reimbursed, but circulating passports and facial photos expose victims to identity theft risks that are difficult to contain.
Reported via Cointelegraph.
Previously: Revolut Leaked Customer Bitcoin History to Scammers Armed with Official Government Email
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
