Revolut

Revolut confirmed that customer information was disclosed to an unauthorized third party after it received fraudulent data requests sent from a legitimate government agency email domain. A group calling itself iamnotavillain then demanded a $3 million ransom, threatening to sell the data of approximately 680 customers within 24 hours.

There was no intrusion. No vulnerability was exploited and no credential was stolen from Revolut. The bank received what appeared to be a lawful request from a real government domain and complied with it. That is the entire attack.

Identity and contact details including dates of birth, postal and email addresses and phone numbers, plus copies of identity documents including passports and driving licences.

Document images are the heavy item. A passport scan satisfies identity verification at institutions that accept a photographed document, which is most of them, and it is the same failure mode as the IDScan entry in this series. The affected population here is small. The per person severity is as high as it gets.

The 680 customers whose documents were released, who did nothing and cannot undo it. Identity documents do not rotate. A passport is replaceable at cost and inconvenience, and most people will not replace one because a bank was deceived.

There is a second class of harm specific to this method. Emergency data requests are used by real law enforcement in genuine urgent cases. Every fraudulent one erodes the process, and the people caught in it are those a bank judged to be subject to legitimate official interest.

Responding to government data requests is a legal obligation, not a lapse. Financial institutions are required to cooperate with law enforcement, and emergency requests exist precisely because some situations do not wait for a warrant.

The control that failed is verification of the requester rather than protection of the data. A message arriving from a genuine government email domain passes every technical check available, because the domain really is the government's. The assumption under audit is that domain authenticity equals request authenticity.

Which customers had identity documents on file and where those images lived. Revolut could answer the account question instantly. The document question is different, because passport and licence scans are image content collected at onboarding and retained for compliance.

That material is held because regulation requires identity verification. It is then retained, often indefinitely, in systems built for account data rather than for document archives. When a request arrives, the process pulls what exists, and what exists is broader than the request usually needs.

The number here is 680, which is small enough to notify properly and large enough to demonstrate the point. The exposure was not sized by what the attacker could break. It was sized by what the bank was holding and willing to release in one response.

A group calling itself iamnotavillain claimed it and demanded $3 million with a 24 hour deadline, which is a small number of victims attached to a large demand and a short clock.

The technique is the notable part rather than the group. Fraudulent emergency data requests have been used against multiple technology and financial companies, and they work because the abuse happens inside a legitimate process that firms are legally obliged to honour.

Verifying requests out of band. A callback to a published agency number, or a request portal with authenticated officers, defeats a forged email from a real domain. The technical checks cannot, because there is nothing technically wrong with the message.

Second, holding fewer documents. Identity verification requires seeing a passport. It does not necessarily require keeping the image once verification is complete and recorded. A bank that retains the verification result rather than the document has far less to hand over when someone asks convincingly.