Revolut appears to have exposed personally identifiable information (PII) for a subset of users due to failing to detect a fraudulent government request.
Exposed data included:
- Copy of passport and/or driver’s licence, plus the verification selfie
- Account statements, IBAN, withdrawal records, and full transaction history including Bitcoin
- Full name, date of birth, occupation
- Home address, email, phone number
While the incident is likely limited in size it seems to have been targeted at high net worth users.
An email alerting users was sent out to multiple Revolut users yesterday.
Source: ZachXBT.
The CEO of Sardine is on LinkedIn saying how it isn’t Revolut’s fault, and in the same breath saying how the controls should have worked (which shockingly includes a plug for Sardine)