Revolut Data Breach: Hackers Blackmail Crypto Figures After Socially Engineering KYC Release
What Happened — A threat actor compromised an Italian government email account and used its valid SPF/DKIM/DMARC signatures to send a spoofed request to Revolut. Believing the request to be authentic, Revolut’s compliance team manually exported KYC files—including names, contact details, bank and crypto‑wallet information, and identity documents—for roughly 680 high‑risk customers. The attacker then threatened to publish the data unless a ransom was paid.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of relying solely on technical email‑authentication checks without a human verification process.
- Highlights the need for continuous monitoring of request‑handling controls and documented evidence that every external data request is vetted.
- Directly tests the effectiveness of security‑awareness training for staff who process sensitive compliance requests.
Who Is Affected – Digital‑banking platforms, cryptocurrency exchanges, and their high‑value customers (primarily crypto‑industry investors).
Recommended Actions
- Institute a formal, multi‑step verification workflow for any external request involving PII or KYC data.
- Enforce MFA and strict role‑based access for compliance/legal personnel handling sensitive data.
- Deploy targeted security‑awareness training that covers spear‑phishing, forged government communications, and social‑engineering red flags.
- Capture and retain evidence of each verification step to support audit readiness and incident investigations.
Technical Notes – The attacker leveraged a compromised government email account (authenticated via SPF/DKIM/DMARC) to bypass Revolut’s email filters. No direct system intrusion was reported, but a remote‑access Trojan was used to gain initial foothold on the government system. Exfiltrated data included names, contact info, bank account numbers, crypto‑wallet addresses, transaction histories, and scanned identity documents. Source: DataBreachToday