Social Engineering Attack on Revolut Leads to 147GB Data Breach and $3M Ransom Demand
Hackers successfully impersonated an Italian government agency to socially engineer Revolut employees into disclosing sensitive customer data — including passports and financial records — over a five-month period. The root failure was the absence of robust identity verification protocols for external data requests, allowing a threat actor to exploit procedural trust rather than technical vulnerabilities. This breach demonstrates that even sophisticated fintech companies remain vulnerable to human-layer attacks when staff lack adequate verification procedures. The extended five-month window also points to serious gaps in anomaly detection and data access monitoring that should have flagged unusual or high-volume data sharing activity far earlier.
Tactical Insight
Immediate actions
- Implement a strict, multi-step verification process for all external data requests, requiring out-of-band confirmation directly with the requesting agency via official contact details.
- Audit all data-sharing activities from the past 12 months to identify any other potentially unauthorized disclosures.
- Alert and notify affected customers as required under applicable data protection regulations (e.g., GDPR Article 33/34).
Long-term improvements
- Establish a formal, documented procedure for handling government and law enforcement data requests, including legal review before any data is released.
- Apply the principle of least privilege so that only authorized personnel with a clear business need can access and export sensitive customer data.
- Conduct regular social engineering awareness training and simulated impersonation drills for all customer-facing and data-handling staff.
Detection measures
- Deploy data loss prevention (DLP) controls to automatically flag and block bulk exports of personally identifiable information (PII) or financial data.
- Set up real-time alerting for anomalous data access patterns, such as unusually large or repeated data pulls by a single user or team.
- Integrate SIEM rules to correlate external data request volumes against historical baselines and trigger reviews for outliers.