Bitcoin Transaction Histories Exposed in Revolut Data Incident

• Revolut disclosed information after receiving a fraudulent request from an unauthorized mailbox operating inside a genuine government agency domain.
• The exposed material may include identity documents, verification selfies, addresses, account statements and complete Bitcoin transaction histories.
• Revolut says it later verified that the request was unauthorized, blocked the address, alerted the agency and began notifying regulators.
• The company has not disclosed the affected agency, the number of customers involved or how the unauthorized mailbox was created.

Revolut disclosed personal and financial information belonging to some customers after treating a fraudulent government information request as legitimate, exposing a weakness in how lawful data demands are authenticated when the requesting authority’s own email infrastructure is compromised.

The request came from a real government domain

The incident differs from a conventional phishing attack because the malicious request was not simply sent from a lookalike email address.

… Continue reading the full article at the original source below.