Revolut confirmed it shared sensitive customer information with an unauthorized party after accepting fraudulent “government” information requests sent from an email address on a legitimate government domain. The company says this was an external impersonation scam (not a system hack) and that customer funds were not affected, but exposed data could enable follow-on identity fraud and scams.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Revolut just handed real customer data to a scammer… from what looked like a real government email. The scammer emailed from a legitimate government domain, asked for IDs, selfies, and transaction history, and Revolut sent it, no system hack, just trust in the email. Here’s the trap: the email feels urgent and official, but it’s unexpected, has no clear case number, and demands way more data than a normal request. If you get an ‘official’ email asking for customer records, stop. Don’t reply from the email, call or message the agency using our approved contact list and verify first.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
