Industry figures have reacted to news Revolut has suffered a data breach that allegedly exposed personal details of about 50,000 customers worldwide.
According to reports, Revolut notified the cyber attack to the Lithuanian State Data Protection Inspectorate, saying its database was compromised through “social engineering methods”.
It is said that info on 50,150 customers worldwide (20,687 of them in Europe), such as names, addresses, e-mail addresses, telephone numbers, part of the payment card data and account details were ripped from its servers.
Writing to customers, Revolut states: “We recently received a highly targeted cyber attack from an unauthorised third party that may have gained access to some of your information for a short period of time. You do not need to take any action, however we wanted to let you know, and sincerely apologise for this incident.”
Revolut said all card data was hashed and that no PINs or passwords were accessed and added: “Although your money is safe, you may be at increased risk of fraud. We recommend that you be especially vigilant for any suspicious activity, including suspicious emails, phone calls or messages.”
One affected customers was unimpressed by Revolut’s response, saying: “I contacted support and asked the which EXACT information of mine was stolen but they couldn’t answer, all they did was giving me the same message of the email.”
Revolut says the incident hit just 0.16% of its 20 million users worldwide.
Deryck Mitchelson, Field CISO at Check Point said: “It appears as though the attack on Revolut was a result of social engineering, which may have also impacted Uber last week. These types of phishing attacks can be very persuasive and can look real, giving them a high chance of success. Training individuals on these tactics is crucial.
“However, even if a social engineering attack is successful, there are plenty of methods to isolate and stop it in its tracks. Organizations need to have their networks properly segmented with multi layers of security.
“There needs to be dedicated administrative accounts with multi-factor authentication (MFA) on every critical service. With MFA and a robust zero-trust strategy in place, the attack surface would have been reduced making lateral movement difficult, meaning the hackers behind this Revolut attack would probably not have gained access to 50,000 accounts.
“Now that they do have access to this data, we will probably see a rise in phishing or smishing attempts requesting people to reset passwords or account details. Any Revolut customers need to be on high alert for unofficial emails or messages that contain malicious links.”
He said the finance and banking sector has always been a hot target for hackers, adding: “According to our researchers, the UK finance industry experienced an average of 849 cyberattacks a week over the last six months.
“Online commerce has skyrocketed in recent years, and the number of people handing over their data to third-party financial services firms has boomed as a result. Those in the banking sector work almost exclusively with funds, personal credentials and other sensitive customer data, all of which have tremendous value to a criminal who could hold this information to ransom, use it to redirect payments, or simply sell to the highest bidder on the darknet.
“Financial institutions need to shift to a prevention-first cybersecurity strategy and be looking at all-encompassing architected solutions that provide visibility and real-time insight instead of focusing purely on remedial strategies.”