Zakaria MOUNDAS

#RevolutConfirmsFakeGovEmailDataBreach Revolut Attacked. Revolut received an information request that appeared to come from a legitimate government agency. The request originated from an unauthorized email account, but one created directly within the official domain's infrastructure. As the message bore valid domain authentication credentials, Revolut honored it "in the reasonable belief" that it was an authentic request. Potentially communicated data: • Identity: full name, date of birth, profession. • Contact: postal address, email, phone. • KYC documents: copy of identification (passport and/or driver's license) + verification selfie provided at account opening. Revolut specifies that no derived facial biometric data (telemetry) was transmitted — only the selfie image itself. • Financial data: account statements (IBAN, status, opening date, wallet reference number), withdrawal history, full transaction history, including Bitcoin. This was not a breach of Revolut's servers, no passwords stolen, no funds moved. It was social engineering via the legal request channel. Much-commented irony: Revolut imposes heavy KYC "for security and the fight against crime," then hands it all over on a fake subpoena.$ON $LAB $LSK