Circuit Wire — a daily news update from the Circuit.
British fintech Revolut confirmed over the weekend that it sent sensitive customer records to fraudsters who emailed requests from a genuine government agency domain. The Record reported that the attackers appeared to target high-net-worth individuals, many of them involved in crypto asset businesses.
The requests carried valid domain authentication, so staff treated them as genuine. Customer notices shared by affected users list a wide range of exposed data. That includes passport or driver's license copies and the verification selfie submitted through the app. Dates of birth, home and email addresses, phone numbers and occupations were also handed over, along with account statements, IBANs, withdrawal records and full transaction histories, including Bitcoin activity.
Revolut said only a limited number of customers were affected and that it contacted each of them directly. "Upon detection, we immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection, and financial regulators," a spokesperson said. The company did not name the agency whose domain was used. Extortion images circulated on Telegram by an account claiming responsibility suggest the email came from an Italian domain. Italian authorities contacted by reporters did not respond.
People claiming responsibility posted samples in several Telegram groups. The Register reported that the snippets appeared to belong to chief executives, sports professionals and performing artists. The posters demanded 10,000 Bitcoin, worth more than $782 million, and threatened to release more data each day until Revolut paid. Revolut declined to comment on the ransom claim. Mark Karpelès, former chief executive of the Mt. Gox bitcoin exchange, said he was among those affected.
Fraudulent emergency data requests are a known route into corporate records. Hackers linked to the Lapsus$ group used compromised law enforcement accounts in 2021 and 2022 to pull user information from Apple, Meta and Discord. The FBI's Internet Crime Complaint Center warned in 2024 of a rise in criminal forum posts selling access to compromised government email accounts for exactly this purpose. Revolut says it serves more than 80 million personal customers and more than 800,000 businesses.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.