Bitcoin activity, passports exposed after Revolut data leak

[shinratensei_]

Companies must verify the government first before they send the data even the email looks "real" from the government. They can contact by phone and that doesn't takes too long so they know that is real or fake.

And the government must clarify this because customers can lose trust to them but customers can't do anything because their data has been moves to the fake government official.

This normally should be the workflow or company guideline in that matter, it wouldn't hurt the company if they simply make sure to check who are the recipient of the data, not to mention involving even a high net worth persons. What exactly would they benefit from cutting corner like this? is it laziness or there is genuinely something being kept from us? Even in my mind, checking with the official government line should be the bare minimum in which they could do alongside with keeping the KYC data secure because they are the one asking for the data and requiring it, us the customers don't even want to go through KYC if possible.

[m2017]

A fake government Email has led to serious data leak from Revolut, there was no breach, they gave it out thinking it was a request from the government. Seems some scammers got some targeted data by asking nicely this time around.

How many more leaks must occur before it is acknowledged that the KYC is an "evil"? How long is the regulator prepared to disregard citizen's right to privacy for the sake of its own ambitions for power?

A fake government email slipped through security controls at digital banking giant Revolut this week, exposing residential addresses, identity documents and bitcoin transaction histories belonging to a wide group of customers.

All that remains is to provide the attackers with a "signpost" pointing to the wallets containing bitcoins, so they don't "get lost" along the way.

The request appeared to come from a legitimate government agency and carried credentials that passed Revolut’s checks. The company handed over customer information before separately contacting the agency and discovering that the request was fraudulent, according to notices sent to affected users.

Why come up with complex hacking schemes? You could just ask politely.

The files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including all bitcoin activity.

In short, everything is set up to make it easy to identify these BTC-owners.

How does the regulator intend to protect these citizens (who dutifully pay their taxes) only to then force them to undergo mandatory verification regarding KYC?

Revolut has yet to disclose how many customers were affected, and did not immediately respond to a CoinDesk request for comment on the matter.

Undoubtedly, Revolut is at fault (due to insufficient data verification), but they were acting in response to an "official government request". What were they supposed to do in that situation? Refuse the "regulator"?

The root cause here lies not with Revolut specifically, but with KYC regime itself, which was imposed by the regulator.

It said in its email that customer funds remained safe and has since notified affected users and regulators and blocked the source of the request.

Client funds are safe. For now. That is, until "guests" show up with a $5 wrench.

What did the client notification look like? "Due to a data breach and for your own safety, you should change your name, appearance, and place of residence - and basically move to another country and disappear"?

The weak point was authorization. Once the request cleared Revolut’s internal checks, someone posing as a government official gained access to the same deeply personal information the bank had collected to satisfy identity and compliance requirements.

In other words, the bank did everything the regulator requires. So, who is to blame after all?

[Sandra_hakeem]

A fake government Email has led to serious data leak from Revolut, there was no breach, they gave it out thinking it was a request from the government. Seems some scammers got some targeted data by asking nicely this time around.

How many more leaks must occur before it is acknowledged that the KYC is an "evil"? How long is the regulator prepared to disregard citizen's right to privacy for the sake of its own ambitions for power?

Asking questions like this is like trying to deny them of their own "hooman rights".

A fake government email slipped through security controls at digital banking giant Revolut this week, exposing residential addresses, identity documents and bitcoin transaction histories belonging to a wide group of customers.

All that remains is to provide the attackers with a "signpost" pointing to the wallets containing bitcoins, so they don't "get lost" along the way.

Mate! I lost it at "The request appeared to come from a legitimate government agency and carried credentials that passed Revolut’s checks. The company handed over customer information before separately contacting the agency and discovering that the request was fraudulent, according to notices sent to affected users[/b]".

Why come up with complex hacking schemes? You could just ask politely.

You get the point now?  

It said in its email that customer funds remained safe and has since notified affected users and regulators and blocked the source of the request.

What did the client notification look like? "Due to a data breach and for your own safety, you should change your name, appearance, and place of residence - and basically move to another country and disappear"?

Bahahaha!!!

[dzungmobile]

Undoubtedly, Revolut is at fault (due to insufficient data verification), but they were acting in response to an "official government request". What were they supposed to do in that situation? Refuse the "regulator"?

The root cause here lies not with Revolut specifically, but with KYC regime itself, which was imposed by the regulator.

Revolut is not an individual user so they have many teams with abundant resources to do things properly, safely and securely. As a company with many resources and more experience than individual users, Revolut should never do things very carelessly like this.

As company, they even have to work internally with compliance team, lawyers and possibly send a letter to government for confirming that legal request. Then they will be able to figure out that was a scam request.

They ignored these important steps for verifying request information, so they were scammed and lost user data to scammers.

[Mr_Brilliant$]

It's surprising how easily our data is given frequently to the government. Those data are damn important as it can be used to actually steal money.  Just the company saying your money is safe is trash. Things can still go wrong at one point in time. Later in the future. This is just to go further and say our data after all is not safe. Government can just wake up and ask for it.

[Call_Me_Guru]

A fake government Email has led to serious data leak from Revolut, there was no breach, they gave it out thinking it was a request from the government. Seems some scammers got some targeted data by asking nicely this time around.

Another carelessness on point. Not minding how they got it, whether through hacking, physical breaking in or by asking nicely, it doesn't matter, a breach has happened, another many victims have been affected. The highest they say is sorry, they keep exposing people's details in the name of regulation, nothing is a good as decentralization and a slight deregulation. Who knows why and who that breach was targeted and why did Revolut got suspicious and inquire with the government later rather than earlier

[dzungmobile]

It's surprising how easily our data is given frequently to the government. Those data are damn important as it can be used to actually steal money.  Just the company saying your money is safe is trash. Things can still go wrong at one point in time. Later in the future. This is just to go further and say our data after all is not safe. Government can just wake up and ask for it.

Governments can ask for it and have it but in this topic and discussion here, it's not about how easily government got data from a company, it's a hacker or a group of hacker whom did that by impersonating government agency and stole Revolut's customer data.

It's a data leak from Revolut but it's an impersonating scam from attackers.

https://www.bitdefender.com/en-us/blog/hotforsecurity/crypto-impersonation-scams-target-investors

[macson]

I still can't wrap my head around how a company that big didn't do stricter verification first before giving all that sensitive data to someone else. I think their promise to handle users' personal data safely is just bullshit, because they don’t seem to have enough safeguards in place to actually keep the data secure. 

I guess they’d rather bury this news deep down and give so many statements to convince users that there’s nothing to worry about --- when in fact their sensitive data is already in someone else's hands.

[Dave1]

As far as the numbers of customers being exposed to the criminals, it was said 68 of their clients.

And the scammers are threatening Revolut as they are exposing the personal data of their clients one by one if they didn't pay the ransom of 10,000 BTC



https://pasqualepillitteri.it/en/news/16139/revolut-extortion-client-dossiers-telegram

[Die_empty]

As far as the numbers of customers being exposed to the criminals, it was said 68 of their clients.

And the scammers are threatening Revolut as they are exposing the personal data of their clients one by one if they didn't pay the ransom of
https://pasqualepillitteri.it/en/news/16139/revolut-extortion-client-dossiers-telegram

The breach affected close to 700 customers, but 680 have been contacted.

We are now in an era where physical or phone contact is becoming essential before any transfer of information or finance is carried out. Emails or chats are no longer enough to verify the genuineness of information. Revolut handed over customers' details before verifying from the government agency. With the advancement of AI, government documents can easily be falsified.

Organizations would have to use Phone calls or even face-to-face meetings to verify requests before giving out important information like customers' personal details.

[#CapsLOck]

I'm more concerned about this being a simple matter of not checking who was requesting the information, it was not a complicated hack. An email as the final authority is a big vulnerability if it includes passports, home addresses and full financial records in a request. Such sensitive data should have a second independent review prior to its release. This is even more alarming since the leaked data might reveal both a person's identity and their activities with Bitcoin, according to the Bitcoin history. This is a great refresher that security of KYC information is as important as security of the account itself.

[Ronsbit]

They made a grave mistake for not conducting due diligence in communication before releasing such sensitive information.
At first, upon receiving such request, they ought to have contacted the requesting organisation or the government directly from the usual method or pattern they normally communicate. This would have justified the request and prepared them for the next line of action so the don't make such a mistake but unfortunately they were quick to release customers information and failed to verify the source of the request. Maybe it could be an inexperienced worker who was on duty that day or he might have been high on something.
This is a clear case of unprofessional conduct from the staff who released the data without a proper verification because before such sensitive information should have been released, they ought to have verified it properly from their end as it would definitely put lives in danger of such information leaks to the public. Now this is the situation of it and how do they protect customers whose information is already in the hands of criminals they know not.

[Lida93]

A fake government Email has led to serious data leak from Revolut, there was no breach, they gave it out thinking it was a request from the government. Seems some scammers got some targeted data by asking nicely this time around.

A fake government email slipped through security controls at digital banking giant Revolut this week, exposing residential addresses, identity documents and bitcoin transaction histories belonging to a wide group of customers.

The request appeared to come from a legitimate government agency and carried credentials that passed Revolut’s checks. The company handed over customer information before separately contacting the agency and discovering that the request was fraudulent, according to notices sent to affected users.

This is 2026 how can they make this mad mistake. How can they not verify to ascertain the authenticity of the source of an email request received before doing anything on it.

Now we can see yet another reason why privacy conscious people are so unwilling to hand over their personal information to some centralized organisations. What stopped Revolut from contacting the government agency for confirmation before sending out the requested data. If they were going to contact the agency anyway.
This either shows incompetency, and a lack of professionalism in their action, and they just can't be reliable since they have already made vulnerable customers data that are in their possession into the hands of scammers.

[Wind_FURY]

The files reportedly included passports or driving licences, verification selfies, names, dates of birth, occupations, home addresses, emails, phone numbers, IBANs, account statements, withdrawal records and full transaction histories, including all bitcoin activity.

THAT is going to be so bad for high net worth individuals.

Does everyone remember Mircea Popescu? The Bitcoin whale who "drowned" in a Puerto Rico beach which was NOT allowed for swimming?

Shower thought - What if his real identity was exposed and he was followed, and tortured to surrender his private keys, then during 2024 it was those nefarious individuals that started to sell Mircea's Bitcoin.

[Emjay24]

As far as the numbers of customers being exposed to the criminals, it was said 68 of their clients.

And the scammers are threatening Revolut as they are exposing the personal data of their clients one by one if they didn't pay the ransom of 10,000 BTC



https://pasqualepillitteri.it/en/news/16139/revolut-extortion-client-dossiers-telegram

This isn't a threat anymore, I think they've started leaking the data gradually, I saw this from X, although it remains unconfirmed across multiple sources, but there's sure a possibility it's happened

REVOLUT ATTACKERS BEGIN LEAKING CUSTOMER PASSPORTS AND KYC SELFIES

The threat actors behind the Revolut data incident have reportedly begun publicly leaking customer information and demanding payment from Revolut, threatening to release additional victims every day until the company pays.

The leaks reportedly include passports and KYC selfies belonging to named individuals, including tennis player Alexander Shevchenko and Gamdom CEO Felix Römer.

https://x.com/BitcoinNewsCom/status/2099605293575397748

Now even if the company pays what is asked of them, the extortion wouldn't stop since they still have the data. The safest is not letting the data get out in the first place. A lot of people over the media says this act is intentional, somehow I'm convinced they're correct.

[SeriouslyGiveaway]

This isn't a threat anymore, I think they've started leaking the data gradually, I saw this from X, although it remains unconfirmed across multiple sources, but there's sure a possibility it's happened

REVOLUT ATTACKERS BEGIN LEAKING CUSTOMER PASSPORTS AND KYC SELFIES

Now even if the company pays what is asked of them, the extortion wouldn't stop since they still have the data. The safest is not letting the data get out in the first place. A lot of people over the media says this act is intentional, somehow I'm convinced they're correct.

Pay ransom money to attackers or don't pay that, it is decision and responsibility of Revolut but with Revolut customers, it's done.

They used personal documents for KYC on Revolut, those documents leaked, now are in hands and devices of hackers. Hackers ask for ransom money but even if they receive the wanted money in full amount from Revolut, and claim that they destroy leaked data, who know and are able to verify what hackers do after receiving ransom money.

It's realistic to say that those people with leaked documents from Revolut will be unsafe forever. They won't be able to revoke validity of all those documents by requesting governments to do that.

[Ucy]

Could aswell see this as test on data privacy. It exposes how vulnerable users who have their private data with custodians or on centralized platforms can be.
This is just a reported case, I believe there are many breaches that go unreported, with consequences that may be as bad as victims getting attacked for their bitcoins in their homes. This is part of the reasons kyc as we know it is dangerous and shouldn't be happening.
And when attacks on such platforms happen many users are affected since the data is not decentralized. Besides it's a serious violation of privacy due to the amount of sensitive information that get handed to complete strangers which may eventually be accessed by data thieves. A Bitcoin compatible model would keep such data decentralized and privacy-friendly.