Revolut has announced that a third party gained unauthorized access to confidential customer data. What makes this case unusual is that there was no technical breach in the classic sense. The attackers used social engineering: they sent official-looking data requests from the email domain of a legitimate government institution, and the requests passed the internal authenticity checks.
What we know
- According to a notification to the Lithuanian data protection authority, 50,150 customers were affected, fewer than half of them in the EU and Norway. There is no information about affected customers in Bulgaria.
- The leaked data includes names, dates of birth, addresses, emails, phone numbers, copies of ID documents, verification selfies, statements, IBANs and crypto transaction history.
- No leak of biometric data, passwords or PINs has been reported.
- Revolut blocked the email address, notified the police and regulators, and stated that its systems and customer funds were not compromised.
- A group calling itself "Revolut Smilik" has reportedly demanded a ransom of 10,000 bitcoin.
Why social engineering works
Verification processes often focus on form rather than context. An official domain, a properly formatted document and a sense of urgency are enough for a request to go through if nobody confirms it through an independent channel. The same logic is used against small businesses: fake invoices, a supplier's "change of bank account", requests from a supposed accountant.
Five lessons for every company
- Confirm through a second channel. Every request for data, a payment or a change of bank account is confirmed by calling a known number, not the number in the email.
- Protect your phone number. Revolut recommends setting a PIN with your mobile carrier or blocking number porting to reduce the risk of SIM swapping.
- Phishing-resistant two-factor authentication. An authenticator app or a physical key instead of SMS wherever possible.
- Keep data to a minimum. The less personal data you store, the less there is to leak.
- Protect your domain. SPF, DKIM and DMARC make it harder for anyone to send emails in your name.
Where your website comes in
Website forms often collect more data than they need. In our projects we collect only what is necessary, show clear privacy information and protect forms from spam. Related: why managers are a frequent target of ransomware attacks.
Topic source: Digitalk: Not hackers but social engineers breached Revolut (in Bulgarian). This article is an independent analysis by Penkov Studio.
