Fintech company Revolut has disclosed a data breach after sharing data from an undisclosed number of customers with a threat actor impersonating a government agency.
Revolut operates in over 160 countries and regions and offers banking, money management, and investment services to more than 80 million customers worldwide, including 800,000 business customers.
In emails sent to affected customers, the company said that the attacker requested the personally identifiable information (PII) via email using a government agency's domain.
"As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request," Revolut told affected customers.
Revolut said that the data sent to the threat actors includes affected individuals' identity details (i.e., full name, date of birth, occupation), contact details (postal address, email address, and telephone number), as well as document and verification data such as copies of your identity documents (passport and/or driver's license) and facial verification images (selfies provided for Know Your Client verification when opening an account).