Social Engineering Attack on Revolut Leads to 147GB Data Breach and $3M Ransom Demand
Written by AI from the linked story. Not reviewed by an editor. How this works
Hackers successfully impersonated an Italian government agency to socially engineer Revolut employees into disclosing sensitive customer data — including passports and financial records — over a five-month period. The root failure was the absence of robust identity verification protocols for external data requests, allowing a threat actor to exploit procedural trust rather than technical vulnerabilities. This breach demonstrates that even sophisticated fintech companies remain vulnerable to human-layer attacks when staff lack adequate verification procedures. The extended five-month window also points to serious gaps in anomaly detection and data access monitoring that should have flagged unusual or high-volume data sharing activity far earlier.
Tactical Insight
Immediate actions
- Implement a strict, multi-step verification process for all external data requests, requiring out-of-band confirmation directly with the requesting agency via official contact details.
- Audit all data-sharing activities from the past 12 months to identify any other potentially unauthorized disclosures.
- Alert and notify affected customers as required under applicable data protection regulations (e.g., GDPR Article 33/34).
Long-term improvements
- Establish a formal, documented procedure for handling government and law enforcement data requests, including legal review before any data is released.
- Apply the principle of least privilege so that only authorized personnel with a clear business need can access and export sensitive customer data.
- Conduct regular social engineering awareness training and simulated impersonation drills for all customer-facing and data-handling staff.
Detection measures
- Deploy data loss prevention (DLP) controls to automatically flag and block bulk exports of personally identifiable information (PII) or financial data.
- Set up real-time alerting for anomalous data access patterns, such as unusually large or repeated data pulls by a single user or team.
- Integrate SIEM rules to correlate external data request volumes against historical baselines and trigger reviews for outliers.