Blockchain researcher ZachXBT suggests that fintech company Revolut may have transferred personal data of some users to third parties, having mistaken a forged request from a government institution for a genuine one. According to information published on ZachXBT's personal channel, the incident began when Revolut received a request for client information that appeared to come from a legitimate government agency and used that agency's official email domain.
According to the investigation, the email in question was accepted by Revolut as authentic because it contained verifiable domain confirmation information. As a result of the company's failure to detect the fraudulent nature of the request, some user information may have been obtained or transferred in response to it.
The potentially affected data includes users' first and last names, dates of birth, occupations, addresses, email addresses and phone numbers, as well as copies of passports or driver's licenses, selfies taken during identity verification, account statements, IBAN information, withdrawal records, and extensive transaction history, including Bitcoin transactions. In its security notice to users, Revolut indicated that facial biometric telemetry data was not affected by the incident.
ZachXBT noted that although the incident currently appears to be limited in scope, it may have specifically targeted users with substantial assets. According to the statement, several Revolut users have recently received security notifications related to this incident.
*This is not investment advice.
end-content
