Neobank Revolut fell victim between September 11 and 12 to a sophisticated social engineering attack. An attacker exploited unauthorized access to a government agency’s email system to send a customer data request indistinguishable from a legitimate legal subpoena. Revolut responded by handing over passports, verification selfies, and Bitcoin transaction histories of targeted clients. The method bypassed all authentication checks: SPF, DKIM, and DMARC protocols all validated the email as legitimate. This breach occurs as Revolut has just obtained full banking authorization in France and is reportedly planning an IPO valuing the company between $150 and $200 billion.
Source: Read the original article
