The hackers targeting Revolut are no longer satisfied with extortion and have begun publicly leaking customers’ personal information. The cybersecurity community International Cyber Digest disclosed on X on September 13 that the hackers had publicly released copies of tennis player Alexander Shevchenko’s and Gamdom CEO Felix Römer’s identity documents. The hackers threatened to continue leaking data daily.
Gamdom CEO’s and Tennis Player’s Passport Selfies Leaked
The cybersecurity community International Cyber Digest disclosed on X on September 13 that the hackers targeting Revolut had officially entered the second phase of the attack, beginning to publicly release customers’ passport selfies and copies of identity documents. The victims whose information has been confirmed as publicly released include tennis player Alexander Shevchenko and Felix Römer, CEO of online crypto casino Gamdom (and Skinscom).
The hackers announced on Telegram that they would continue publishing more data every day until Revolut “paid up,” marking the escalation of the incident from private extortion to public pressure.
Revolut Explains the Attack Method: An Impersonation Scam Using an Official Government Domain
Revolut told Cointelegraph on Saturday that the incident was caused by a “sophisticated external impersonation scam.” The hackers used the official domain of a real government agency to send scam emails that fabricated legitimate investigation requests for user data from Revolut. Because the emails came from a legitimate government domain rather than a lookalike domain commonly used in phishing emails, Revolut’s compliance team mistakenly deemed them legitimate government investigation requests and provided the relevant customer data.
This means the relevant government’s email system may have been hacked or taken over, making the incident’s impact broader than that of a typical corporate cybersecurity breach. Revolut said that a “limited number” of customers were affected and that the company’s systems and customer funds were not impacted.
Six Types of Leaked Personal Information Revolut Notified Affected Users About
Revolut informed affected users on Friday that the leaked data covered the following six categories:
· Full name, date of birth, and occupation
· Contact information: email address, phone number, and home address
· Account details and complete transaction history
· Bitcoin transaction records, including purchase and sale amounts and timestamps
· Facial-verification selfies
· Copies of identity documents, including passports and driver’s licenses
This means the hackers possess not only basic identity information but also a complete picture of customers’ financial activity on Revolut, from everyday spending to cryptocurrency purchases and sales. Facial-verification selfies combined with complete personal information pose an extremely high risk of identity theft.
Why Leaked Bitcoin Transaction Records Pose a Special Risk to the Cryptocurrency Community
Revolut is currently one of the few digital banks to integrate Fiat accounts with cryptocurrency purchases and sales in the same app. Users’ Bitcoin transaction records, holdings, and trading timing on Revolut have all been leaked, effectively giving the hackers a complete picture of customers’ crypto Asset Allocation.
Notably, the victims include Gamdom CEO Felix Römer, indicating that the hackers may be deliberately targeting figures in the cryptocurrency industry for targeted leaks to increase their leverage in negotiations. For users who trade cryptocurrency through Revolut, their BTC transaction records, trading amounts, and timestamps are now in the hackers’ hands. They are advised to closely monitor their credit reports and account activity.
Three Key Points to Watch Going Forward
As the hackers have announced that they will continue leaking data daily, the following three key points are worth monitoring. First, whether Revolut will contact the hackers or pay the ransom—the financial institution’s response strategy to the extortion will become a focus going forward. Second, which country’s government agency the exploited “official government domain” belongs to, as this involves a cybersecurity vulnerability in that country’s government and could trigger follow-up investigations at the diplomatic and regulatory levels.
Third, whether the UK Financial Conduct Authority (FCA) or other regulators will fine Revolut as a result. Although the attack was caused by the impersonation of government emails, Revolut’s verification process when receiving government investigation requests will still come under scrutiny to determine whether it was sufficiently rigorous.
Frequently Asked Questions
What types of data were leaked in the Revolut leak, and which notable individuals have been affected?
The leaked data includes full names, dates of birth, contact information, complete transaction records, Bitcoin transaction records, facial-verification selfies, and copies of passports and driver’s licenses. The notable individuals confirmed to have been affected so far include tennis player Alexander Shevchenko and Gamdom CEO Felix Römer.
How did the hackers obtain Revolut customer data?
According to Revolut’s explanation to Cointelegraph, the hackers used the official domain of a real government agency to send impersonation scam emails. Revolut’s compliance team mistakenly treated them as legitimate government investigation requests and provided customer data, indicating that the relevant government’s email system may have been hacked.
What threats did the hackers make after publicly leaking the data, and what is Revolut’s official position?
The hackers announced on Telegram that they would continue publishing more data every day until Revolut “paid up.” Revolut said that a “limited number” of customers were affected and that the company’s systems and customer funds were not impacted, but it has not yet stated whether it will respond to the hackers’ demands.
