[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH74PkzZBAhEn_Zxv0W994eyvaH93_QNU519Ejo4uJ0c":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"23d888a6-a520-4a70-8f89-aacb77aec9a9","Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom","revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom-23e014","Revolut allegedly fed customer information to hackers impersonating an Italian government agency for five months. The post Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom appeared first on SecurityWeek.","Hackers impersonating an Italian government agency tricked Revolut into handing over personal data, including passports and financial information, for approximately five months. The threat actor, known as 'IAmNotAVillain', is demanding a $3 million ransom and claims to have exfiltrated 147GB of data from both Revolut and an Italian law enforcement agency. Italian police are investigating the incident.","Revolut customer data compromised for five months via fake government requests.","https:\u002F\u002Fwww.securityweek.com\u002Frevolut-data-breach-5-months-680-high-profile-accounts-3m-ransom\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-17T13:57:41+00:00","2026-09-17T14:00:22.378564+00:00",8,[17,20,23],{"name":18,"type":19},"Revolut","vendor",{"name":21,"type":22},"IAmNotAVillain","threat_actor",{"name":24,"type":25},"fake government requests","campaign","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":26,"icon":28,"name":29,"slug":30},null,"Breaches","breaches",[32,34,39,44],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"domain","pec.interno.it","Compromised email address domain used for fraudulent government requests.",[18],{"controls":56,"vendors":138},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":87,"name":88,"problem":89,"products":90},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","email-fraud-defense","Proofpoint Email Fraud Defense","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-fraud-defense","DMARC deployment and monitoring with hosted SPF and DKIM services.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,125,132],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":121,"product_name":122,"url":123,"description":124},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":116,"product_name":129,"url":130,"description":131},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":157},"social-engineering-attack-on-revolut-leads-to-147gb-data-breach-and-3m-ransom-demand","Social Engineering Attack on Revolut Leads to 147GB Data Breach and $3M Ransom Demand","Hackers successfully impersonated an Italian government agency to socially engineer Revolut employees into disclosing sensitive customer data — including passports and financial records — over a five-month period. The root failure was the absence of robust identity verification protocols for external data requests, allowing a threat actor to exploit procedural trust rather than technical vulnerabilities. This breach demonstrates that even sophisticated fintech companies remain vulnerable to human-layer attacks when staff lack adequate verification procedures. The extended five-month window also points to serious gaps in anomaly detection and data access monitoring that should have flagged unusual or high-volume data sharing activity far earlier.",[144,145,146,147,148,149,150,151,152,153,154,155,156],"CIS Control 3: Data Protection","CIS Control 14: Security Awareness and Skills Training","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 MP-6: Media Sanitization","GDPR Article 5: Principles Relating to Processing of Personal Data","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 33: Notification of a Personal Data Breach to the Supervisory Authority","GDPR Article 34: Communication of a Personal Data Breach to the Data Subject","NIST CSF PR.AT-1: Awareness and Training","ISO\u002FIEC 27001 A.7.2.2: Information Security Awareness, Education and Training",{"CIS Control 3: Data Protection":158,"NIST SP 800-53 SI-4: System Monitoring":159,"NIST SP 800-53 AC-2: Account Management":160,"NIST SP 800-53 MP-6: Media Sanitization":161,"NIST CSF PR.AT-1: Awareness and Training":162,"CIS Control 13: Network Monitoring and Defense":163,"NIST SP 800-53 AT-2: Literacy Training and Awareness":164,"CIS Control 14: Security Awareness and Skills Training":165,"GDPR Article 25: Data Protection by Design and by Default":166,"GDPR Article 5: Principles Relating to Processing of Personal Data":167,"GDPR Article 34: Communication of a Personal Data Breach to the Data Subject":168,"ISO\u002FIEC 27001 A.7.2.2: Information Security Awareness, Education and Training":169,"GDPR Article 33: Notification of a Personal Data Breach to the Supervisory Authority":170},"Data protection controls, such as verified request processes, ensure sensitive customer data is only released to authenticated parties.","Monitoring systems for unusual data access or transfers helps detect a long-running data leak.","Account management controls who can access and export customer data, limiting what social engineering can extract.","Media sanitisation controls ensure sensitive data is properly handled and disposed of, limiting what can be disclosed.","Awareness training for all staff covers verifying external requests and recognising impersonation.","Monitoring data flows helps detect large or unusual data disclosures over an extended period like five months.","Literacy training on social engineering helps employees verify the identity of external requesters.","Awareness training helps staff recognise impersonation of government agencies requesting customer data.","Data protection by design includes robust verification of external requests before releasing personal data.","Processing principles require security and confidentiality, which failed when customer data was disclosed to an impostor.","Affected customers must be informed when the breach poses a high risk, as with passport and financial data.","Security awareness and training would help staff spot and challenge fraudulent requests impersonating authorities.","A breach of passports and financial records must be reported to the supervisory authority within 72 hours."]