Skip to navigation

Threat reportData BreachTL-2026-2498

Revolut Discloses Data Breach via Government-Impersonation Social Engineering, Exposing Customer Financial and Passport Data

highACTIVE

Revolut disclosed a data breach in which an unauthorized third party used a legitimate, domain-authenticated government agency email account to submit fraudulent requests for customer information, which Revolut staff fulfilled as a routine legal-compliance request.

Key facts for Revolut fake government request

IdentifiersTL-2026-2498
SeverityHIGH
Exploitation statusNo known exploitation
Affected productsRevolut Revolut customer KYC/compliance data (identity documents, verification selfies, financial records)
MITRE ATT&CK techniquesT1048 Exfiltration Over Alternative Protocol, T1078 Valid Accounts, T1199 Trusted Relationship, T1213 Data from Information Repositories, T1586.002 Email Accounts, T1589 Gather Victim Identity Information, T1591 Gather Victim Org Information, T1598 Phishing for Information, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsfinancial services, fintech, banking, cryptocurrency
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for Revolut fake government request

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2498 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fraudulent Government-Domain KYC/Legal Data Request Email

Detects an inbound email from a domain-authenticated (SPF/DKIM-pass) government/regulatory agency domain requesting customer KYC, financial, or identity data, where the reply-to address does not match the sending domain or no pre-verified liaison contact exists for that domain. This is the exact pattern Revolut's compliance team was fooled by: an unauthorised mailbox on a legitimate government domain issuing a fraudulent data request that passed domain-authentication checks and was fulfilled as a routine legal-compliance request.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1598, T1656, T1199, T1586.002
  • Data sources: email_gateway (O365 Message Trace / Proofpoint), email_authentication_logs (DKIM/SPF/DMARC), verified_government_domain_and_liaison_lookup
  • Severity: critical
  • Confidence: medium

Splunk SPL

index=email sourcetype="ms:o365:reporting:messagetrace" OR sourcetype="proofpoint:message"
| eval sender_domain=mvindex(split(sender,"@"),1)
| lookup verified_government_agency_domains.csv domain AS sender_domain OUTPUT is_known_gov_domain
| lookup verified_legal_request_contacts.csv domain AS sender_domain OUTPUT verified_liaison_contact
| where is_known_gov_domain="true"
| eval subject_lower=lower(subject)
| where match(subject_lower, "(?i)(kyc|customer data|information request|legal request|subpoena|court order|regulatory request|account information)")
| eval dkim_pass=if(match(authentication_results,"dkim=pass"),1,0), spf_pass=if(match(authentication_results,"spf=pass"),1,0)
| where dkim_pass=1 AND spf_pass=1
| eval reply_to_domain=mvindex(split(reply_to,"@"),1)
| where isnull(verified_liaison_contact) OR reply_to_domain!=sender_domain
| stats count min(_time) as first_seen max(_time) as last_seen values(recipient) as internal_recipients by sender, sender_domain, subject, message_id
| table first_seen, last_seen, sender, sender_domain, subject, internal_recipients, message_id

Microsoft KQL

EmailEvents
| where Timestamp > ago(24h)
| where AuthenticationDetails has "SPF pass" and AuthenticationDetails has "DKIM pass"
| extend SenderDomainName = tostring(split(SenderFromAddress, "@")[1])
| join kind=leftouter (
    ExternalGovernmentDomains_CL
    | project Domain_s
) on $left.SenderDomainName == $right.Domain_s
| where isnotempty(Domain_s)
| where Subject has_any ("KYC", "customer data", "information request", "legal request", "subpoena", "court order", "regulatory request")
| extend ReplyToDomain = tostring(split(extractjson("$.replyTo", AdditionalFields), "@")[1])
| where isempty(ReplyToDomain) or ReplyToDomain != SenderDomainName
| project Timestamp, SenderFromAddress, SenderDomainName, Subject, RecipientEmailAddress, NetworkMessageId

Sigma

title: Fraudulent Government-Domain KYC/Legal Data Request Email
id: e7f1c2a4-6b3d-4f8a-9c2e-1a7d5f3b8e21
status: experimental
description: Detects an SPF/DKIM-authenticated inbound email from a known government/regulatory agency domain requesting KYC, identity, or financial customer data where the reply-to address does not match the sending domain or no pre-verified legal-liaison contact exists for that domain, matching the fraudulent-government-impersonation vector used against Revolut's compliance workflow.
references:
    - https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
    - https://attack.mitre.org/techniques/T1598/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-14
tags:
    - attack.reconnaissance
    - attack.t1598
    - attack.resource-development
    - attack.t1586.002
    - attack.initial-access
    - attack.t1199
    - attack.defense-evasion
    - attack.t1656
logsource:
    category: application
    product: m365
    service: exchange
detection:
    selection_auth:
        AuthenticationDetails|contains|all:
            - 'SPF pass'
            - 'DKIM pass'
    selection_domain:
        SenderDomainName|endswith:
            - '.gov'
            - '.gov.uk'
    selection_subject:
        Subject|contains:
            - 'KYC'
            - 'customer data'
            - 'information request'
            - 'legal request'
            - 'subpoena'
            - 'court order'
            - 'regulatory request'
    filter_verified_liaison:
        ReplyToDomain: SenderDomainName
    condition: selection_auth and selection_domain and selection_subject and not filter_verified_liaison
falsepositives:
    - Legitimate recurring legal/compliance liaison correspondence from a government domain not yet catalogued in the verified-liaison lookup
    - Government agency address migration not yet reflected in the trusted-contact list
level: high

Known false positives:

  • Legitimate recurring legal/compliance liaison correspondence from a government domain not yet added to the verified-liaison-contact lookup
  • Government agency migrating to a new but not-yet-catalogued email address

Tuning notes: Maintain and regularly refresh the verified_government_agency_domains.csv and verified_legal_request_contacts.csv lookups from an out-of-band, legal-team-owned source (never from the inbound email itself); alert only on domains present in the government-domain lookup to avoid drowning in ordinary phishing noise.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Fraudulent Government-Domain KYC/Legal Data Request Email · unlock with TL Creds
  • Anomalous Bulk KYC Dossier Export Following External Legal-Request Email · unlock with TL Creds
  • Outbound KYC/PII Data Exfiltration Following Bulk Export · unlock with TL Creds
  • Fraudulent Government-Domain KYC/Legal Data Request Email · unlock with TL Creds
  • Anomalous Bulk KYC Dossier Export Following External Legal-Request Email · unlock with TL Creds
  • Outbound KYC/PII Data Exfiltration Following Bulk Export · unlock with TL Creds
  • Anomalous Bulk KYC Dossier Export Following External Legal-Request Email · unlock with TL Creds
  • Outbound KYC/PII Data Exfiltration Following Bulk Export · unlock with TL Creds

Indicators of compromise for Revolut fake government request

As of 2026-09-14, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-2498.

13 indicators of compromise · unlock with TL Creds. Compare plans

How Revolut fake government request works

Exposed data for a limited number of customers — reportedly skewed toward high-net-worth individuals — includes passports/driver's licenses, KYC verification selfies, IBANs, account statements, and full transaction histories including Bitcoin activity; the threat actor has since begun publicly leaking samples on X and Telegram while demanding roughly 10,000 BTC (~$782M) not to release more.

On September 12, 2026, UK-based neobank Revolut confirmed a data breach stemming not from a technical intrusion but from abuse of its legal/regulatory information-request process. Revolut stated: "Revolut received a request for customer information that appeared to come from a legitimate government agency. The request came from an unauthorised email account sent directly using the official government agency's email domain," and that because "the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request." Revolut has declined to name the government agency involved, the country/market affected, or the number of impacted customers, describing it only as a "sophisticated external impersonation scam" affecting a "limited number of customers."

Customer notifications sent around September 11, 2026 indicate the exposed data set includes full name, date of birth, occupation, postal address, email, and phone number; copies of passports and/or driver's licenses; KYC facial-verification selfies; and financial records comprising account statements, IBANs, withdrawal records, and complete transaction histories including Bitcoin-related activity. Revolut says its core systems and customer funds were not compromised — this was a data-disclosure incident against the compliance/KYC request-handling workflow, not a platform intrusion.

On-chain investigator ZachXBT added detail Revolut's notification omitted, stating the operation appears to have specifically targeted high-net-worth users, assessing the goal as building "detailed profiles of wealthy individuals, using their KYC documents and cryptocurrency transaction history linked to their real identities" for potential downstream "fraud, impersonation, or extortion" — a population facing elevated risk of SIM-swapping and physical/cryptocurrency-focused extortion once identity and holdings data is exposed.

The incident escalated on September 13, 2026 when a threat actor began posting leaked identity documents and selfies on X (Twitter) and Telegram, naming specific individuals including professional tennis player Alexander Shevchenko and Felix Römer, CEO of Gamdom and Skinscom (Römer responded publicly on X: "Ah wtf @Revolut"). The Register additionally reported leaked samples attributed to "CEOs, sports professionals, and performing artists." The actor stated: "We're gonna start releasing more and more data everyday until Revolut pays for leaking their customers," separately claimed it would release "more messages, data and commentary on how Revolut's team operates," and accused Revolut of "handing information to countries outside its jurisdiction" and of general negligence around privacy. The actor also demanded a reported ~10,000 BTC (approximately $782M USD) to halt further leaks — a figure surfaced publicly by the dark-web-monitoring account DailyDarkWeb, which itself cautioned that the attacker's identity, the ransom figure, the claimed high-profile victim list, and the authenticity of the leaked material were all unconfirmed and uncorroborated as of publication.

Revolut says it immediately blocked the malicious email address on detection and notified the relevant government agency, law enforcement, data-protection authorities, and financial regulators; it declined to name the impersonated agency on the stated grounds that doing so "would allow other regulated platforms to search their own legal-request logs for messages from the same mailbox." Security researchers questioned Revolut's controls: Muhammad Yahya Patel of Huntress asked why "a regulated financial institution handling highly sensitive data didn't have sufficiently rigorous verification controls to catch it," while Jamie Akhtar of CyberSmart characterized the exposed data set as "a complete identity theft kit" carrying downstream identity-fraud and phishing risk. This is not Revolut's first disclosed breach — the company reported a separate 2022 incident affecting 50,150 customers — underscoring a structural weakness common across fintech/KYC-handling organizations: reliance on email domain authentication (DKIM/SPF-style checks) alone as a trust signal for high-sensitivity legal/regulatory data requests, without an out-of-band verification step (e.g., callback to a known point of contact) before releasing PII, identity documents, or financial records.

MITRE ATT&CK techniques by tactic:

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Defense Evasion

T1078 Valid Accounts; T1684.001 Impersonation

Initial Access

T1199 Trusted Relationship

Collection

T1213 Data from Information Repositories

Resource Development

T1586.002 Email Accounts

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1598 Phishing for Information

Impact

T1657 Financial Theft

Remediation for Revolut fake government request

Immediate actions

  • Treat inbound legal/government/law-enforcement data-request emails as untrusted regardless of passing DKIM/SPF/DMARC — domain authentication proves the sending infrastructure, not the requester's legitimate authority to request the data.
  • Require out-of-band verification (callback to a published, pre-verified agency contact number — never a number or reply address supplied in the request itself) before releasing any KYC, identity-document, or financial-record data in response to a legal/government request.
  • Audit and, if needed, revoke standing trust granted to any mailbox or workflow that can trigger bulk release of customer PII/KYC data based on email content alone.
  • Monitor dark-web/leak-site and social-media (X, Telegram) channels for further disclosure of the stolen data set to scope exposure and support customer notification.

Workarounds

  • Pending process hardening, require dual-approval (two-person authorization) for any KYC/PII bulk release triggered by an external request.

Longer-term hardening

  • Implement a formal legal-request-intake process with identity verification of the requesting officer/agency independent of the inbound email (e.g., verified portal, signed legal process, or agency liaison contact list) before any compliance team member can fulfill a data request.
  • Apply data minimization and need-to-know segmentation so no single compliance workflow can export full KYC dossiers (ID scans + selfie + IBAN + full transaction history) in one action.
  • Add anomaly detection/alerting on bulk exports of KYC/identity-document data triggered by inbound email-based requests.
  • Run social-engineering/BEC tabletop exercises specifically simulating spoofed or compromised government/law-enforcement data-request emails against compliance and legal teams.

Affected and fixed versions

  • Revolut — Revolut customer KYC/compliance data (identity documents, verification selfies, financial records)
    Vulnerable versions: A limited, undisclosed subset of Revolut's global personal customer base (Revolut serves 80M+ personal and 800K+ business customers), reportedly skewed toward high-net-worth individuals

Timeline of Revolut fake government request

  • locked-ioc-11 disclosed a separate, earlier data breach affecting 50,150 customers, establishing that this is not the company's first customer-data exposure incident.
  • locked-ioc-11 begins emailing affected customers to notify them their identity documents, selfies, and financial records were exposed.
  • locked-ioc-11 states it alerted the relevant government agency, law enforcement, data protection authorities, and financial regulators, and confirms core systems and customer funds are unaffected.
  • locked-ioc-11 publicly confirms the breach, describing it as a 'sophisticated external impersonation scam' in which an unauthorised email account used a legitimate government agency's domain to submit fraudulent information requests.
  • The threat actor expands its public messaging beyond the ransom demand, accusing locked-ioc-11 of 'handing information to countries outside its jurisdiction' and of general negligence around privacy, and threatens to release 'more messages, data and commentary on how locked-ioc-11's team operates.'
  • Named leak victim locked-ioc-5, CEO of locked-ioc-13 and locked-ioc-8, publicly responds to the leak on X with 'Ah wtf @locked-ioc-11.'
  • On-chain investigator locked-ioc-12 publicizes that the breach appears specifically targeted at high-net-worth locked-ioc-11 customers, assessing the likely goal as building identity/financial dossiers for downstream fraud, impersonation, or extortion — detail omitted from locked-ioc-11's own customer notification.
  • The threat actor demands a reported ~10,000 BTC (~$782M USD) and threatens to release additional stolen data every day until locked-ioc-11 pays, per posts surfaced by dark-web-monitoring account locked-ioc-3.
  • A threat actor begins posting leaked identity documents and verification selfies on X and locked-ioc-9, naming individuals including tennis player locked-ioc-1 and locked-ioc-13/locked-ioc-8 CEO locked-ioc-5.
  • Security researchers publicly question locked-ioc-11's verification controls: locked-ioc-10's locked-ioc-2 and locked-ioc-7's locked-ioc-4 characterize the incident as reflecting insufficiently rigorous request-verification processes for a regulated financial institution.
  • Security and tech media (BleepingComputer, TechCrunch, The Register, Help Net Security, Security Affairs, Infosecurity Magazine, and others) widely report on the breach, its social-engineering attack vector, and the ongoing extortion attempt.

Sources cited for Revolut fake government request

Previous and next in data breach

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats