Revolut handed customer KYC and bitcoin transaction data to a scammer impersonating a government agency
Revolut has confirmed that it disclosed confidential customer data to outsiders. An attacker sent forged requests from a legitimate government agency's email domain. According to the publication's headline, the disclosed information included KYC data and bitcoin transaction data. Revolut called it a “sophisticated external impersonation scheme,” blocked the address and said that its systems and customer funds were unaffected. The report does not specify how many customers were affected. Linking identities to bitcoin activity enables targeted phishing and the selection of targets for physical coercion.
If you are a Revolut customer and bought or withdrew bitcoin there, assume your identity may have been linked to this activity. Do not respond to calls, emails or messages claiming to come from Revolut, government agencies or a “security department.” Do not share your seed phrase, PIN or confirmation codes with anyone, and do not follow links in such messages. If you withdrew coins to your own wallet, keep in mind that the addresses may be linked to your name. Details are linked below.
Sources: