According to information published on September 12 by on-chain investigator ZachXBT, scammers gained access to sensitive information belonging to some Revolut users. Independent cybersecurity outlet International Cyber Digest reported that they have already published part of that data and demanded payment from the company, threatening to release new data every day.
How the Leak Happened
In comments to Cointelegraph, Revolut said it had uncovered a sophisticated external fraud scheme in which an unauthorized party used a genuine government domain to send fake requests for information.
After discovering the scheme, the company blocked the sender's address and notified the relevant government agency, law enforcement, and financial regulators.
Revolut's team says its internal systems and customer funds were not affected.
What Data Leaked
ZachXBT earlier reported that the leak included copies of passports and driver's licenses, verification selfies, bank statements, IBANs, withdrawal history, and full transaction history, including bitcoin transactions.
Customers' full names, dates of birth, occupations, home addresses, emails, and phone numbers may also have been exposed. The investigator wrote that the number of affected users is likely limited, and that the attackers may have targeted wealthy clients specifically.
One of those affected is Marc Zeller, founder of the Aave Chan Initiative and a former major delegate of the Aave DAO. Zeller himself revealed that his data was among those leaked.
Zeller said that shortly before the leak, he received a demand from Revolut to provide a large amount of data or risk having his account closed within 20 days.
“This is a stark reminder that the KYC process provides no real benefit and puts customers at risk,” he stressed.
Read also: