Global Security Mag Online

Articles

• Revolut tricked into handing over passports, financial data through fake gov’t requests - Expert Comments

  14 septembre, par Suzu Labs, Black Hills Information Security and Xcape Inc. — primetime

  Digital banking and financial services platform Revolut has confirmed a data breach after an unauthorized party used an email account on a legitimate government agency domain to submit fraudulent requests for customer information, according to crypto investigator ZachXBT, who shared a customer notification sent out by the company. Revolut said its own systems were not compromised and customer funds were not affected.

  The information disclosed may include names, dates of birth, addresses, phone numbers, email addresses and copies of passports and driver's licenses, as well as verification selfies. Some affected customers were also told that account statements, IBANs, withdrawal records and full transaction histories, including Bitcoin transactions, may have been exposed.

  Revolut has not disclosed how many customers were affected or identified the government agency whose email domain was used. The company blocked the email address after discovering the scheme.

  ZachXBT reported that the incident appeared to target high-net-worth customers, although Revolut has not confirmed that claim. Revolut currently serves more than 80 million customers worldwide.

  Experts with Suzu Labs, Black Hills Information Security and Xcape Inc. offer perspectives on the matter.

  Denis Calderone, CTO, Suzu Labs:

  “This attacker wasn't spoofing a government email address. They were logged into a legitimate government agency's email infrastructure and sent the request from inside it. SPF passed. DKIM passed. And Revolut's compliance team treated that as sufficient verification to release passports, driver's licenses, verification selfies, full transaction histories including Bitcoin activity, IBANs, and withdrawal records for what appears to be a targeted set of high-net-worth customers."

  “Think about how most financial institutions handle a wire transfer request. You get the request, you verify it through an independent channel, you call back on a known number, you confirm authorization. Nobody releases six figures based solely on the fact that the email came from a real domain. But that appears to be essentially what happened here with data that, for affected customers, is more damaging than a wire fraud loss. You can reverse a wire. You can't un-leak a passport."

  “The FBI's November 2024 Private Industry Notification on fraudulent data requests laid out a model that applies here. That advisory focused on emergency requests, but the core prescriptions are just as relevant for routine government data requests, especially when the data being released is this sensitive. The FBI told companies to "apply critical thinking to any emergency data requests received" and recommended "contacting the sender and originating authority to discuss the request further." Whether a request comes in as an emergency or through standard legal compliance channels, the data being handed over is the same. Passports, KYC selfies, and full financial transaction histories don't become less valuable to an attacker because the request wasn't urgent. Out-of-band verification, callback procedures to independently verified agency contacts, and specialized legal request intake portals should be standard for any government data request involving sensitive customer records, not just the ones that come in marked urgent.”

  John Strand, Owner, Black Hills Information Security, Inc.:

  “This story just highlights that no matter how advanced defensive technology gets, and no matter how sophisticated attacks become with all the new exploits we're seeing, the human element is still one of the easiest ways to get access to data."

  “What makes this one particularly interesting is how targeted the attackers were. To be honest, that makes the attack look even more realistic. They clearly had some understanding of the normal processes, how those processes worked, and the channels these requests would normally come through."

  “That's critical for an attacker trying to pull something like this off. And once again, it proves that technology alone is not going to save us.”

  Eric Capuano, Director of SOC Operations, Black Hills Information Security:

  “Revolut called this a sophisticated external impersonation scam. It was not. Someone sent email from a mailbox on a real government agency domain, and every technical check Revolut ran came back clean because the mail genuinely came from that domain. SPF and DKIM confirm a message came from where it claims. They say nothing about who is sitting at the keyboard. Revolut's own notification says the quiet part out loud: the request carried valid domain authentication, so it was fulfilled. That is authentication being treated as authorization, and it is the entire incident."

  “The company says its systems were not compromised, and that is accurate and beside the point. The data walked out through a process working as designed. In most companies the government and law enforcement request queue is a shared mailbox, a person with a legal obligation, and a deadline. There is usually no callback to a number the company looked up itself, no second approver, and no logging that the SOC ever sees. Nobody gets an alert when the compliance team emails passport scans, verification selfies, and a full transaction history to an outside address, because that is a Tuesday for that team. Security spends its budget on the front door and this stuff goes out the loading dock."

  “The customers are the ones stuck with it. A password gets rotated in a minute. A passport number, a date of birth, and the selfie you took to open the account do not. Those are the exact artifacts other institutions accept to verify identity and to recover an account, so the people in this set are now easier to impersonate everywhere else they bank. Pair that with full transaction history and Bitcoin records, and whoever received it has a list of who is worth working on and how much they are worth. ZachXBT says it looks like high net worth customers were the target and Revolut has not confirmed that, but targeting would fit what was asked for."

  “Three things worth doing this week if you handle customer data. Find out who at your company can fulfill a government or law enforcement request and have them walk you through it while you watch. If the verification step is that the email passed authentication, add an out-of-band callback to a number you pull from the agency's own published directory, plus a second approver for anything involving identity documents or full account history. Then get that queue logged somewhere the SOC reads, because right now most of us cannot even reconstruct what left. And if you have ever received requests from that agency, go pull your mail logs for the same window. A mailbox that gets used once usually gets used more than once.”

  Donald McFarlane, Board Member, Xcape Inc.:

  “Financial institutions may be required to retain sensitive identity information, but that makes strict controls and data minimization more important, not less."

  “We should not be yeeting passports, transaction histories and other sensitive customer data to someone simply because a request arrives from a government email address. A government domain is not a substitute for authenticating a valid warrant and its legal authority, and using a secure process to return the information.”

• Vigilance.fr - Siemens SIMATIC S7-PLCSIM Advanced : overload via Multicast Network Traffic, analyzed on 14/07/2026

  14 septembre, par Vigilance.fr

  An attacker can trigger an overload of Siemens SIMATIC S7-PLCSIM Advanced, via Multicast Network Traffic, in order to trigger a denial of service.

  View online : https://vigilance.fr/vulnerability/...

• Vigilance.fr - Siemens SIMATIC S7-PLCSIM Advanced : surcharge via Multicast Network Traffic, analysé le 14/07/2026

  14 septembre, par Vigilance.fr

  Un attaquant peut provoquer une surcharge de Siemens SIMATIC S7-PLCSIM Advanced, via Multicast Network Traffic, afin de mener un déni de service.

  Voir en ligne : https://vigilance.fr/vulnerabilite/...

• Vigilance.fr - Xen : Man-in-the-Middle via XAPI SDKs, analyzed on 14/07/2026

  14 septembre, par Vigilance.fr

  An attacker can act as a Man-in-the-Middle on Xen, via XAPI SDKs, in order to read or write data in the session.

  View online : https://vigilance.fr/vulnerability/...

• Vigilance.fr - Xen : Man-in-the-Middle via XAPI SDKs, analysé le 14/07/2026

  14 septembre, par Vigilance.fr

  Un attaquant peut se positionner en Man-in-the-Middle sur Xen, via XAPI SDKs, afin de lire ou modifier des données de la session.

  Voir en ligne : https://vigilance.fr/vulnerabilite/...