Revolut sent identity data, contact details, and documents to hackers posing as a government agency

Revolut fell for a spoofed government email scam, leaking sensitive customer data to attackers Compromised info includes IDs, selfies, account statements, IBANs, and full transaction histories Criminals now allegedly leaking data on Telegram, demanding 10,000 BTC (~$780M) ransom from Revolut Digital banking platform Revolut was tricked into giving away a treasure trove of sensitive customer data to hackers, and it is now coming back to bite it.

The company told TechCrunch that it recently fell victim to a “sophisticated external impersonation scam” in which the threat actor “utilized a legitimate government agency domain email to submit fraudulent requests for information”.

In other words, the attackers either broke into, or spoofed, an email address belonging to the police, tax authorities, or other government bodies with statutory powers to demand information, and used them to demand Revolut hand over sensitive customer data .

Demanding ransom Cybernews reports that the compromised data includes customers’ birth dates, postal and email addresses, occupation, phone numbers, and copies of identity documents.

TechCrunch added that verification selfies, account statements, and transaction histories may have also been compromised, together with IBANs, withdrawal records, complete transaction histories, and Bitcoin transactions.

Should these reports be confirmed, this will be a bonafide fiasco for Revolut.

"Upon detection, ⁠we immediately blocked the address and ​alerted the relevant government agency as ​well as enforcement agencies, data protection, and financial regulators," a company spokesperson told Reuters over the weekend.

So far, we don’t know exactly how many people are affected.

Revolut said it is a “very limited” number, and that all of them had been notified already.

According to Coin Bureau , the criminals have started leaking sensitive data on Telegram, in a bid to pressure Revolut into paying a ransom demand.

The publication shared screenshots of the threat actors apparently leaking a selfie and “full KYC” of a CEO of a crypto casino website, saying that the crooks are now demanding 10,000 BTC in exchange for deleting the data.

This would put the ransom demand at approximately $780 million which is obscene even by criminal standards.

"This one is deeply concerning and the implications for affected customers go well beyond a standard data breach notification," said Muhammad Yahya Patel, vCISO & Cybersecurity Advisor at Huntress.