On September 12, Revolut has disclosed confidential client data to a not authorized, fake requests submitted to them from an email account using an authentic government domain.
This leak of information is very sensitive, as it may include personal information of customers connected with Bitcoin transactions. Viable verification selfies, account statements and transaction history could have likely been accessed.
Hackers that targeted Revolut data demand 10,000 Bitcoin which is worth more than US$782 million, to stop releasing additional information about the customers. The group of hackers call themselves Revolut Smilik. They have already published personal data of tennis player Alexander Shevchenko and Gamdom CEO Felix Römer. They threaten the company to publish more information, if the ransom is not paid.
How attackers exploited Revolut’s verification process
The incident at Revolut did not involve hackers accessing the company’s data center or its internal system operationally. Instead, the attackers leveraged the systems in place for dealing with mandatory information requests from authorities.
The hackers created an email address on the domain of a real government agency to send a forged request for customer information. Since the email had been sent from an official-looking email domain, it successfully passed all compliance and verification processes until Revolut realized the requests were fake.
Following that, Revolut shared information with unauthorized recipients. This case shows how hackers use the trust in governmental domains and process flaws without needing to break into the internal system of the bank.
Revolut’s response
Having learned what happened, Revolut blocked the fake email address and informed the government agency represented by its domain. The company reported the incident to law enforcement and data protection authorities.
At the moment of the publication, Revolut stated that very few of the customers were affected because of the case. Revolut has contacted affected customers and taken steps to block the fraudulent sender.
Revolut’s official email sent to affected users stated:
Revolut received a request for information disguised as a legitimate government agency request. The request originated from an unauthorized email account created directly within an official government authority’s domain infrastructure. The communication carried genuine domain authentication credentials leading Revolut to fulfill the request under the reasonable belief that it was an authentic government agency request.
Once we became aware of the issue, we independently contacted the relevant government agency to validate the request, ultimately alerting the authority to the unauthorized account apparently operating within their domain. Upon confirming the compromise, Revolut immediately blocked the address across all internal systems, initiated notifications to relevant regulators, and applied precautionary protection measures for affected customers.
ZachXBT, a cryptocurrency investigator, made a statement on Telegram and included several details that weren’t mentioned in Revolut’s notification: IBANs, withdrawal history, jobs, and Bitcoin transaction history. He described the situation as somewhat limited and targeting wealthy individuals.
This case demonstrates how dangerous such fraudulent requests can be despite their origin from what seems to be a legitimate government domain. It also raises important issues regarding how banks and financial technology firms can better verify mandatory requests for information, limit information provided, and identify abnormal behavior before sharing sensitive data on their customers.
