Revolut attackers threaten daily customer data leaks

[Oshosondy]

I do not know if I should post about this since yesterday that I have read about it. Revolut is a digital banking and financial services application that is offering multicurrency accounts, cards, international transfers, currency exchange, and other financial services according to what I found about about the company online, but depending on the country, the company also offer some crypto exchanges in some countries like United Kingdom and many countries in Europe.

Threat actors who obtained sensitive Revolut customer information appear to have begun posting the information online and are threatening to release more data every day until “revolut pays.”

I think selfies and other identity customers information are compromised by the hackers, release few online and saying Revolut have to pay if they want them to stop releasing more customers information. Revolut said the breach affected a “⁠limited number” of customers, and its systems and customer funds are unaffected.

https://cointelegraph.com/news/revolut-attackers-threaten-daily-customer-data-leaks?utm_campaign=rss_partner_inbound&utm_medium=rss&utm_source=rss_feed

The bad side of this is that there are many physical attacks which people do not know the origin. Who knows if this can be origin of another crypto physical attack.

[m2017]

I do not know if I should post about this since yesterday that I have read about it. Revolut is a digital banking and financial services application that is offering multicurrency accounts, cards, international transfers, currency exchange, and other financial services according to what I found about about the company online, but depending on the country, the company also offer some crypto exchanges in some countries like United Kingdom and many countries in Europe.

Naturally, this should not be left unsaid.

Threat actors who obtained sensitive Revolut customer information appear to have begun posting the information online and are threatening to release more data every day until “revolut pays.”

Hmm, do you think Revolut will pay the ransom and "save" its user's data? The hackers are demanding 10,000 BTC.

I think selfies and other identity customers information are compromised by the hackers, release few online and saying Revolut have to pay if they want them to stop releasing more customers information. Revolut said the breach affected a “⁠limited number” of customers, and its systems and customer funds are unaffected.

They gained access to virtually all the data that makes it possible to determine a user's level of wealth and easily locate them if necessary.

Identification details: full name, date of birth, occupation;
Contact information: postal address, email, and phone number;
Documents and verification: a copy of a passport or driver's license and a selfie taken during identity verification.

Account statements with IBANs and wallet references, records of withdrawals, and full transaction history

In the wrong hands, this data could put Revolut users at risk.
 

The bad side of this is that there are many physical attacks which people do not know the origin. Who knows if this can be origin of another crypto physical attack.

Read above to see exactly what data was stolen from Revolut. With that information, only a blind person would fail to identify and locate the owners.

[AnonymtNorskNr]

I do not know if I should post about this since yesterday that I have read about it. Revolut is a digital banking and financial services application that is offering multicurrency accounts, cards, international transfers, currency exchange, and other financial services according to what I found about about the company online, but depending on the country, the company also offer some crypto exchanges in some countries like United Kingdom and many countries in Europe.

Naturally, this should not be left unsaid.

Threat actors who obtained sensitive Revolut customer information appear to have begun posting the information online and are threatening to release more data every day until “revolut pays.”

Hmm, do you think Revolut will pay the ransom and "save" its user's data? The hackers are demanding 10,000 BTC.

I think selfies and other identity customers information are compromised by the hackers, release few online and saying Revolut have to pay if they want them to stop releasing more customers information. Revolut said the breach affected a “⁠limited number” of customers, and its systems and customer funds are unaffected.

They gained access to virtually all the data that makes it possible to determine a user's level of wealth and easily locate them if necessary.

Identification details: full name, date of birth, occupation;
Contact information: postal address, email, and phone number;
Documents and verification: a copy of a passport or driver's license and a selfie taken during identity verification.

Account statements with IBANs and wallet references, records of withdrawals, and full transaction history

In the wrong hands, this data could put Revolut users at risk.
 

The bad side of this is that there are many physical attacks which people do not know the origin. Who knows if this can be origin of another crypto physical attack.

Read above to see exactly what data was stolen from Revolut. With that information, only a blind person would fail to identify and locate the owners.

So, from what I understand, this is connected to all to limited customers? Or is it all countries and private accounts?

[PrivacyG]

My opinion is.  The only good thing that can come out of this situation is that the people affected and some of the rest will learn to value their Privacy more and rely less on Third Parties.

I do not have any good feeling about the attackers, if Revolut wants to 'pay' then it will probably end up in a continuous loop of payments until Revolut simply gives up and the attackers will have the documents to black mail with again AND the free money.  There is this VERY small possibility that the attackers would actually keep their word, although I very much doubt that they would.  And even if they do now, no body can guarantee they will not threaten again in the future when they will be hungry again.

[examplens]

I just came across this Revolut data leak investigation on X.
Are the people at Revolut stupid, or just naive?

"For security, Revolut sent the password to the downloadable zip file in a separate email." < How do I add a clown smiley

BREAKING: Duel can report that the Revolut hacker used a "spray and pray" strategy, sending hundreds of cryptocurrency transaction IDs to Revolut and asking for the associated account details. Revolut complied.

This explains the sheer volume of data the hackers were able to obtain over several months. The hacker, who goes by the name "IAmNotAVillain," told Duel that he would present Revolut with hundreds of crypto transaction IDs and deposit addresses he believed to be associated with high value Revolut clients. Compelled by the fake "European Investigation Order," Revolut would send back large numbers of files containing all associated customer information.

We received and verified authentic .eml copies of the emails sent by Revolut. One of the emails contained 10 folders, each one named after a customer. Each folder contained ID pictures, a selfie, account data, and transaction data, fully unredacted.

For security, Revolut sent the password to the downloadable zip file in a separate email.

It has been a point of curiosity in our investigation: how exactly did the hacker manage to pull off getting data specifically on high value clients? What did he ask for? Now we know. All he had to do was knock using data from public blockchains, and Revolut provided all of the requested information in a near-firehose format.

We are working on a larger investigative piece that will answer a few more questions, including the fallout between "Villain" and "Smilik," more chat logs, and a video showing the extent of the hacker's files. We wanted to release this piece of information ASAP so that everyone was aware of how it was done.

https://x.com/korraflow/status/2099971250735153227?s=20

[Fiatless]

I just came across this Revolut data leak investigation on X.
Are the people at Revolut stupid, or just naive?

"For security, Revolut sent the password to the downloadable zip file in a separate email." < How do I add a clown smiley

Are there no other means to confirm if a European Investigation Order (EIO) document is valid? I assume that there should be a means to contact the competent judicial authority that issued this order. It sounds foolish to release such a large amount of sensitive information because of unverified documents. The situation is looking more like an insider job than a genuine attack.

[SFR10]

Are the people at Revolut stupid, or just naive?

If I were to guess, I'd say both ^[SMH] and apparently, it doesn't end there: “They are so scared of government agencies that they are almost over-compliant.”
^{- The answer to "this post on X" is also interesting (clearly shows how incompetent they are)!}

• BTW, out of the 680 leaked customer data records ^{[according to a post from the Financial Times]}, most of them appear to belong to users from "Switzerland and France".

[AnonymtNorskNr]

I just came across this Revolut data leak investigation on X.
Are the people at Revolut stupid, or just naive?

"For security, Revolut sent the password to the downloadable zip file in a separate email." < How do I add a clown smiley

BREAKING: Duel can report that the Revolut hacker used a "spray and pray" strategy, sending hundreds of cryptocurrency transaction IDs to Revolut and asking for the associated account details. Revolut complied.

This explains the sheer volume of data the hackers were able to obtain over several months. The hacker, who goes by the name "IAmNotAVillain," told Duel that he would present Revolut with hundreds of crypto transaction IDs and deposit addresses he believed to be associated with high value Revolut clients. Compelled by the fake "European Investigation Order," Revolut would send back large numbers of files containing all associated customer information.

We received and verified authentic .eml copies of the emails sent by Revolut. One of the emails contained 10 folders, each one named after a customer. Each folder contained ID pictures, a selfie, account data, and transaction data, fully unredacted.

For security, Revolut sent the password to the downloadable zip file in a separate email.

It has been a point of curiosity in our investigation: how exactly did the hacker manage to pull off getting data specifically on high value clients? What did he ask for? Now we know. All he had to do was knock using data from public blockchains, and Revolut provided all of the requested information in a near-firehose format.

We are working on a larger investigative piece that will answer a few more questions, including the fallout between "Villain" and "Smilik," more chat logs, and a video showing the extent of the hacker's files. We wanted to release this piece of information ASAP so that everyone was aware of how it was done.

https://x.com/korraflow/status/2099971250735153227?s=20

Why is this classified as "hackers" in the news then? It appears to be a form of social engineering that anyone with sufficient time and resources could pull off. Revolut has just been slacky here.

[Z-tight]

Are the people at Revolut stupid, or just naive?

To think that this is a part of their statement when the data breach was made public:

when it said customer data was leaked due to a “sophisticated external impersonation scam”

I don't know about those who work at Revolut, but there is nothing sophisticated about how the attackers were able to get sensitive customer data from them. They just knocked with a fake order and Revolut started handing people's personal information over to the those asking, how pathetic.
No chance they are going to give in to blackmail though, because at what point does it stop. So the attacker might as well just save themselves time and post the information they have, too bad for those affected.

[PrivacyG]

I don't know about those who work at Revolut, but there is nothing sophisticated about how the attackers were able to get sensitive customer data from them. They just knocked with a fake order and Revolut started handing people's personal information over to the those asking, how pathetic.

They probably thought they would look way too stupid to publicly state that they fell for one of the most popular phishing scams since the existence of the Internet, or particularly of the electronic mail.  There is simply no way they can offer even a single reason they are not stupid at this point.

[BitMaxz]

I used Revolut before in marketing free credit on Bing Ads and AdWords due to a free virtual card, but since the beginning of crypto getting hype and adding crypto to their service, I can't use them anymore.


I wonder if the attackers actually have the correct customer data? Maybe the attacker took the data from somewhere else and used it to threaten Revolut?

If this is a physical attack, then that's an inside job only if all data they provided is actually Revolut customers, but if not, they may be trying to scam Revolut and customers.

[examplens]

I wonder if the attackers actually have the correct customer data? Maybe the attacker took the data from somewhere else and used it to threaten Revolut?

If this is a physical attack, then that's an inside job only if all data they provided is actually Revolut customers, but if not, they may be trying to scam Revolut and customers.

They are not any attackers. Someone presented himself as an investigative authority and requested user data for some specific transactions. They sent them everything they requested. And that happened for months.
Therefore, the team from Revolut has been sending information about its users for months, and yet they did not even seriously check the reality of the "investigation" in which they participated.

[Z-tight]

Therefore, the team from Revolut has been sending information about its users for months, and yet they did not even seriously check the reality of the "investigation" in which they participated.

Yeah, and it is simply unbelievable, were they trying to be 'extra' compliant, was it an oversight, or just clowns running this business. I just cannot wrap my head around how easy it was for this person to get possession of a large number of customers personal information.

Kyc is really very dangerous and this presents a very perfect example of why it is. Funny thing is, all Revolut would do right now is apologise, while the victims now have to worry about their safety and security. I hope this event results in a lawsuit, should anyone suffer any kind of loss from this.

[AnonymtNorskNr]

Therefore, the team from Revolut has been sending information about its users for months, and yet they did not even seriously check the reality of the "investigation" in which they participated.

Yeah, and it is simply unbelievable, were they trying to be 'extra' compliant, was it an oversight, or just clowns running this business. I just cannot wrap my head around how easy it was for this person to get possession of a large number of customers personal information.

Kyc is really very dangerous and this presents a very perfect example of why it is. Funny thing is, all Revolut would do right now is apologise, while the victims now have to worry about their safety and security. I hope this event results in a lawsuit, should anyone suffer any kind of loss from this.

Revolut is liable for anything that happens from that data now. Meaning they could owe millions to the ones affected according to the law. For sure they will enter into an NDA (Non-Disclosure Agreement) with them. A licensed financial company can't just hand over sensitive information like that without reimbursement.

[joniboini]

For sure they will enter into an NDA (Non-Disclosure Agreement) with them. A licensed financial company can't just hand over sensitive information like that without reimbursement.

I'm fairly skeptical it will be anything significant to be honest, judging from the fact that previous data leaks ends up with nothing and companies still continue operating as usual. Is there a case in the US where a company paid a lot of compensation for similar issue? At the very least, I've never seen one in my country or region. Some of them did disappear, more so because they got wrecked by hackers stealing their funds too.

[Z-tight]

Revolut is liable for anything that happens from that data now. Meaning they could owe millions to the ones affected according to the law.

The truth is that it would not be that straightforward, especially because these companies have a lot of resources for litigation. Data leaks are very common and in most cases the company that suffers the breach just moves on like nothing happened. However, if many people lose their funds directly because their data fell into the hands of bad actors, then there's a possibility they can file a class-action lawsuit against the service, though it doesn't guarantee that they'll win.

[_act_]

Hmm, do you think Revolut will pay the ransom and "save" its user's data? The hackers are demanding 10,000 BTC.

The hackers are now demanding for 6000 XMR which is around $3 million according to where I just read it from. This is where I just read about it: https://decrypt.co/378472/revolut-hackers-demand-3m-monero-ransom-threaten-to-sell-customer-data-report

But that is still huge amount of money.

It is very possible the hackers will reduce the price or Revolut may bid the price down if they care about their customers. Bit I do not think any company care about their customers to the point of paying such amount of money.

It is better Revolut customers sue Revolut if the data is out.

Revolut says it has received no direct contact or demand.

[PrivacyG]

or Revolut may bid the price down if they care about their customers.

I would personally say paying that price or even 'bidding' is the next most stupid thing they can do after they responded to that false e-mail.  No body guarantees they will not take the ransom AND still sell or even simply publish all that information all over the Internet.

They should pay the affected customers, not the attackers.  They will hopefully eventually pay any way if a law suit comes up.

[alani123]

Makes me wonder why should a bank retain this information after checking.

Modern computing allows for files to be bashed and stored in a manner that can't be reversed and accessed at all, I my to verify future identity checks without the data being stored anywhere.

So why should revolut keep passport pictures of millions of individuals is so beyond me.

[boyptc]

Even if Revolut pays the ransom, there's no guarantee that these leakers will stop from doing so.

It is very possible the hackers will reduce the price or Revolut may bid the price down if they care about their customers. Bit I do not think any company care about their customers to the point of paying such amount of money.

IMHO, they shouldn't negotiate with the hackers.

What they should do is to improve their systems and security rather than paying them. But what's leaked is already there and they have to compensate the users for it instead and guarantee that this won't ever happen again.