As reported by BleepingComputer, Revolut has disclosed a data breach in which customer KYC data — including passports, driver's licenses, facial verification selfies, IBANs, and full transaction histories — was handed to a threat actor who impersonated a government agency using that agency's own email domain. The attacker's messages passed domain authentication checks, leading Revolut staff to believe the request was legitimate.

Key Takeaway: As reported by BleepingComputer, Revolut has disclosed a data breach in which customer KYC data — including passports, driver's licenses, facial verification selfies, IBANs, and full transaction histories — was handed to a threat actor who impersonated a government agency using that agency's own email domain.

This incident is not a technical exploitation in the traditional sense. There is no CVE, no unpatched software, no malware payload. What failed here is a human verification process — and that makes it both more dangerous and harder to defend against than a conventional perimeter breach.

The Authentication Fallacy

Revolut's statement notes that the communication "carried valid domain authentication credentials," which led staff to fulfill the request. This reveals a widespread and dangerous assumption in enterprise security: that passing SPF, DKIM, and DMARC checks equates to verified authority. It does not. Email authentication confirms that a message originated from an authorized mail server for a given domain — it says nothing about whether the sender is authorized to request sensitive customer data, whether the request itself is lawful, or whether the account behind the domain has been compromised.

If the government agency's mail infrastructure was compromised, or if a legitimate agency email account was hijacked, then the attacker would naturally pass all authentication checks. This is a variant of Business Email Compromise (BEC) — the same category of attack that accounts for billions in losses annually according to FBI IC3 data — but directed at data custodians rather than finance teams.

Why KYC Data Is the Real Prize

The exposed data set is exceptionally high-value. Passports, driver's licenses, and facial verification selfies are the raw materials of identity fraud. Combined with full transaction histories and IBANs, this is enough to conduct synthetic identity creation, account takeover at other financial institutions, social engineering of additional targets, and in the case of high-net-worth individuals (which crypto investigator ZachXBT suggests were targeted), potentially physical security threats.

This is not a credentials dump. This is a complete identity kit for each affected individual. The downstream impact will persist for years — passports don't expire quickly, and you cannot rotate your face.

The Process Gap

Why KYC Data Is the Real Prize
No out-of-band verification: A data request from any external entity — government or otherwise — should require secondary verification through a known, pre-established channel (phone number on file, secure portal, in-person). Email alone should never be sufficient.
No authorization matrix: Not every government request is legally compelable. Staff need clear escalation paths and legal review for any data disclosure, especially of biometric and identity document data.
Insufficient logging on data export: Pulling KYC documents and transaction histories should trigger automated alerts, approval workflows, and audit trails — not a single-staff fulfillment.

Shield53 Recommendations

Immediate Actions

  • Implement mandatory out-of-band verification for all external data requests, regardless of apparent sender authority. Verify through a phone number obtained independently — not from the email itself.
  • Establish a formal data disclosure authorization workflow requiring dual approval and legal sign-off for any release of KYC, biometric, or financial records.
  • Audit recent external data requests retroactively. If this attacker succeeded once, there may be prior unfulfilled or fulfilled attempts.
  • Brief all customer-facing and compliance staff on BEC variants targeting data custodians. This is not just a finance-team problem.

Strategic Actions

  • Deploy DLP controls on exports of identity documents and transaction histories. Any bulk export should require workflow approval.
  • Tabletop exercise simulating a government impersonation BEC. Measure detection time and escalation behavior.
  • Review legal request intake processes with counsel. Ensure staff understand what types of requests require a warrant, subpoena, or court order — and what does not.
  • Consider breach notification obligations under GDPR, UK GDPR, and other applicable frameworks. KYC data including biometrics is special category data with heightened requirements.
The fundamental lesson: email authentication proves delivery integrity, not request legitimacy. Until organizations separate those two concepts in their operational procedures, this attack pattern will continue to succeed.