Revolut Data Breach Exposes Sensitive Customer Records via Fraudulent Government Requests Revolut, the British fintech firm, has confirmed a data breach in which an unauthorized third party obtained sensitive customer records by submitting fraudulent information requests through an email address using a legitimate government agency’s domain. Unlike traditional cyberattacks, the breach did not involve compromising Revolut’s app or banking infrastructure. Instead, the attacker exploited trust in an apparently authentic government communication, leading to the release of customer data through an established disclosure process. The fraudulent request originated from an email account under an unnamed government agency’s official domain, carrying valid domain-authentication credentials (SPF, DKIM, and DMARC). Revolut processed the request under the assumption it was legitimate, later characterizing the incident as a “sophisticated external impersonation scam.” While the company confirmed that its systems and customer funds remained unaffected, the breach exposed a wide range of sensitive data. Affected records included full names, dates of birth, occupations, postal and email addresses, phone numbers, passport or driver’s license copies, facial images from onboarding, account statements (IBANs, opening dates, wallet references), withdrawal records, and complete transaction histories including Bitcoin activity. Revolut stated that biometric facial telemetry was not compromised. The combination of verified identity documents and financial details poses significant risks for identity fraud, phishing, and targeted extortion. Revolut described the number of affected customers as “limited” but did not disclose the exact figure, the compromised government agency, the duration of the breach, or whether the incident was confined to a single country. However, crypto investigator ZachXBT suggested the operation may have targeted high-net-worth users. Separately, a threat actor using the alias “IAmNotAVillain” claimed that multiple Italian law-enforcement departments were compromised and that the breach lasted six months, allegedly yielding 147 GB of data. These claims, including a circulated screenshot showing archives labeled “Document Revolut,” remain unverified. Revolut stated it blocked the fraudulent email address upon detection and notified the relevant government agency, law enforcement, data-protection authorities, and financial regulators. While the company emphasized that its systems were not breached, the exposure of durable identity documents and financial records creates long-term risks for affected customers. The incident underscores a critical vulnerability in government-data-request workflows: authenticated email alone is insufficient for high-risk disclosures. Organizations handling such requests should implement additional safeguards, including independent verification, case-number validation, dual approval, anomaly detection, and strict data minimization. The full scope of the breach including the compromised agency, duration, and victim count remains unclear as investigations continue.

Major Cyberattack Disrupts La Poste and French Banking Services Ahead of Christmas On Monday, December 22, 2025, a large-scale DDoS (Distributed Denial of Service) cyberattack crippled critical services of La Poste, France’s national postal operator, and its banking subsidiary, La Banque Postale. The attack, which began around 6:30 AM, rendered key platforms—including Colissimo (parcel shipping), Digiposte (digital storage), and postal labeling systems—unavailable, disrupting last-minute holiday deliveries and financial services just 48 hours before Christmas. The outage was severe enough to prompt La Poste’s management to authorize the closure of select post offices, though payment systems remained operational due to a separate, unaffected data stream. While the group confirmed the incident as a DDoS attack, some experts questioned whether the disruption stemmed from a more sophisticated breach, given the scale of the downtime. Other major French banks—including Caisse d’Épargne and Banque Populaire—also experienced slowdowns or service interruptions the same morning. Both institutions attributed the issues to "dysfunction" rather than a cyberattack, though speculation persists about a potential coordinated campaign. The attack’s timing exacerbated its impact, as millions of customers relied on La Poste’s services for urgent parcel shipments and digital banking access. While La Banque Postale’s mobile app and website gradually resumed functionality, La Poste’s main site remained offline for hours. The incident follows a similar disruption on December 20, raising concerns about repeated targeting of critical infrastructure. No group has claimed responsibility, but the scale and persistence of the attacks suggest possible state-backed involvement, with some analysts pointing to pro-Russian hacking collectives active in recent French cyber incidents. As of reporting, no data breaches or unauthorized system access have been confirmed.