Revolut disclosed it was deceived into sharing highly sensitive customer data after receiving fraudulent information requests that appeared to come from a legitimate government email domain. The attacker’s email passed domain authentication, making it harder to detect, and the shared data may enable follow-on scams and identity fraud.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Revolut shared passport scans and full transaction histories because of one email that looked like it came from a real government address. The message said, “This is an official request from our department,” and asked them to reply with identity documents, facial verification images, bank statements, and full Bitcoin transaction history. Here’s the trap: the email really did come from inside a government domain, so filters trusted it. But there was no clear department name, no case reference, and the scope was way too broad for a normal request. If any email asks for ID documents, facial images, or full transaction history, pause and verify it through a known-good channel, like calling the official number on file, before you send a single file.
Revolut says a third party posing as a government agency tricked the company into disclosing some customers’ personal and financial data. The attacker used an email address on a legitimate government agency domain, causing the request to be treated as a real legal inquiry. Revolut says customer…
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
Revolut confirmed it shared sensitive customer information with an unauthorized party after accepting fraudulent “government” information requests sent from an email address on a legitimate government domain. The company says this was an external impersonation scam (not a system hack) and that…
Revolut confirmed that an attacker impersonated a government agency using an email address on that agency’s real domain to obtain sensitive customer records. Revolut says only a limited number of customers were affected and that customer funds and Revolut systems were not accessed.
Revolut says it handed over sensitive customer identity and financial data after receiving what looked like a legitimate government information request. The email came from inside a real government agency’s email domain and passed authentication checks, so staff processed it before later…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
