Revolut, Europe’s biggest fintech, confirms breach exposing sensitive customer information
Revolut, Europe’s largest fintech company, has confirmed that an impersonation scam exposed personal information belonging to about 680 customers. Attackers reportedly compromised an Italian government email system and used a legitimate agency domain to send fraudulent requests that appeared official. The affected accounts are believed to have been targeted because their owners were suspected of holding cryptocurrency, with exposed data reportedly including home addresses.
Revolut said its internal systems and customer funds were not compromised. The company blocked the address involved, notified authorities and contacted affected customers. The Financial Times separately reported that an alleged hacker demanded a $3 million ransom and threatened to publish the stolen data, although Revolut says it has received no direct demand
Former Mt. Gox CEO Mark Karpelès was among those affected and said his home address was exposed, prompting him to contact police in Tokyo over safety concerns. He also said one victim was allegedly asked to pay $50,000 to have their data deleted. The incident comes as Revolut, recently valued at about $115 billion, considers a potential dual listing in London and New York.
- Money Transfer Service
- Freemium
- Proprietary
External links
- Hackers demand Revolut pay $3mn ransom after data breachFinancial Times
- Revolut reportedly facing $3m ransom demand after hackers steal hundreds of customers’ datathe Guardian
- Hackers Demand $3M Ransom in Revolut Data LeakOCCRP
- Revolut hack: criminals steal data of 700 European clients, demand $3m ransomeuronews
- Revolut confirms customer data breach through fake government requestsTechCrunch
Comments
Italian here. One of our local governmental entities fucked up, that much is true.
That said, Revolut has shown not to have the slightest hint of what correct transfer of personal information to authorities looks like. In Italy, and I believe elsewhere as well, the request for personal information for investigative purposes should always be accompanied by the signed request of a PA (magistrato in Italian).
Not only they never asked to see one, but they transferred the data unencrypted and when the attacker(s) got the form request wrong, they helped them get it right.
Tried them, looks like "good salmon", easy to start but when you get a feeling of the system and you try to END you account you find that the "salmon" is actually a "rotten herring", it is almost like you have to pay Revolut the let you go, what is that called again? "Ransom?" "No, it can't be, they are are ....."
Well, Revolut (as a British company) is a successful "neobank" (a bank with physical bank offices) but a moderately successful financial tech company (about £1B of net revenue, which is much less than any physical bank in Europe). The IPO was planned as up to $200B, which is much too high for this net revenue. And even if it gets more licenses to become a more complete bank in many countries (like offering mortgages and insurances), it doesn't get much more clients since banking is a very saturated market. Also, Revolut has already faced many critics about regulatory compliance in the past years. So yes, not as secure as an good old bank (and many neobanks are owned by physical banks that already have the licenses) if you've got a lot of money to put in a vault.
This is why we can’t trust Revolt anymore especially when they blocked both CalyXOS And GrapheneOS because they are “insecure” when Android 9 is already dead by the time 14 came out stupid Corporate jerks being cringe as always and never improving in any shape or form