Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom

Hackers successfully impersonated an Italian government agency to socially engineer Revolut employees into disclosing sensitive customer data — including passports and financial records — over a five-month period. The root failure was the absence of robust identity verification protocols for external data requests, allowing a threat actor to exploit procedural trust rather than technical vulnerabilities. This breach demonstrates that even sophisticated fintech companies remain vulnerable to human-layer attacks when staff lack adequate verification procedures. The extended five-month window also points to serious gaps in anomaly detection and data access monitoring that should have flagged unusual or high-volume data sharing activity far earlier.