Revolut Confirms Limited Data Exposure After Fraudulent Government Email Request
Revolut has confirmed the exposure of personal documents and transaction histories belonging to a limited number of customers after the company responded to a fraudulent request that appeared to originate from a government body.
The incident was disclosed on 13 September. Revolut, a London-based financial technology company operating as a digital bank without physical branches, serves approximately 70 million clients worldwide. Since March 2026 it has held a full banking licence in the United Kingdom under the supervision of the PRA and the FCA.
The attack did not involve any compromise of Revolut systems. Instead, the perpetrators submitted the request using an unauthorised email account that possessed valid credentials from a government domain, causing the message to appear legitimate to the recipient.
Data handed over included copies of passports and driver’s licences, selfies used for identity verification, full names, dates of birth, occupations, postal addresses, email addresses and telephone numbers. The package also contained bank statements showing IBAN details, complete transaction histories and records of Bitcoin activity.
The combination of verified identity documents, selfies and detailed financial records significantly increases the risk of new account fraud and highly credible social-engineering attacks that reference real transactions.
Revolut confirmed that customer funds remained secure and that its systems were not breached. The company has blocked the unauthorised email source, notified the relevant authorities and contacted all affected customers. No group has claimed responsibility and there is currently no indication that the data has been sold or published.
Related articles
Uber Confirms Data Breach Exposing Drivers' License Records via Contractor Fireworks AI
Uber has notified thousands of drivers that their personal information and driver's license details were stolen during an October incident at one of its technology contractors. The breach occurred at Fireworks AI, a startup providing access to open-source AI models, after attackers compromised internal credentials. Stolen data includes driver's license information affecting 2,567 residents in Massachusetts, 3,430 in South Carolina, and 1,873 in Rhode Island, with additional notifications sent in Illinois and California. Fireworks AI also confirmed the compromise of client data, including payment details and private AI training datasets, impacting other customers such as Notion. The attackers are believed to be financially motivated and were targeting tokens for large language models. This marks Uber's second reported data incident this year following the earlier Uber Freight breach.
Beget Hosting Provider Restores 95% of Virtual Hosting Servers After Destructive Cyberattack
Russian hosting provider Beget has recovered a significant portion of its infrastructure following a cyberattack that occurred in the night between November 1 and 2, 2026. Attackers gained access to the management plane and executed wiping scripts, resulting in complete data loss across the cloud infrastructure including VPS, S3, and Kubernetes environments. File-level backups of VPS instances were preserved and are now being used for recovery. The company has restored 95% of virtual hosting servers and 94% of dedicated servers while gradually re-enabling domain management functions and the control panel. Beget declared force majeure and temporarily lost accreditation as a registrar for .RU and .RF domains. Technical support has been partially restored through the control panel for affected customers, with responses taking longer due to high volume of requests.
FirstVDS Announces Compensation After VMmanager 6 Zero-Day Breach
FirstVDS has detailed compensation measures for clients affected by the October 17 incident involving a zero-day vulnerability in VMmanager 6. Attackers exploited the flaw in the virtualization platform developed by ISPsystem to access portions of the provider's network infrastructure and data belonging to some customers. Clients were forced to reset passwords, keys, and tokens while facing restricted server management and delayed support responses. The company will recalculate charges for unavailable services and issue account balance certificates for support waits exceeding 12 hours, but will not reimburse costs related to credential changes or data compromise. ISPsystem later confirmed the attack targeted a specific build of VMmanager 6 Hosting used by hosting providers, with exploitation aided by Nginx request handling behavior. The vendor released security updates, reworked protective architecture, and collaborated with Kaspersky Incident Response and Kaspersky Threat Research teams.
Four Words Instead of a Password: Why Passphrases Fail Against Real Breaches and Infostealers
Hive Systems' 2026 password cracking table shows an eight-character complex password lasting 132 years under bcrypt, yet human-chosen variants like o#mA24ft fall in three seconds on an RTX 5090. Kaspersky's analysis of 231 million leaked passwords from 2023-2026 reveals 48 percent crack in under a minute and 60 percent within an hour, driven by predictable patterns such as trailing digits, years, and transliterated Russian words. NIST's SP 800-63B-4 update removed mandatory character rules, raised standalone password length to 15 characters, and banned periodic rotation. Diceware passphrases deliver 52 bits with four words and 77.5 bits with six, but only when generated randomly; human-selected phrases from pop culture or song lyrics collapse under dictionary attacks. Infostealers, not offline cracking, dominate theft, with Flashpoint reporting 2.1 billion credentials stolen in cleartext last year. FIDO passkeys reached five billion active keys by May 2026, yet remain vulnerable on compromised devices. The article concludes that passphrases suit only a handful of master secrets while random strings from managers handle the rest.