Revolut 資料外洩：虛假政府要求利用安全漏洞，揭露客戶數據

最近的 Revolut 資料外洩事件利用了虛假的政府請求，凸顯了關鍵的安全漏洞和網路犯罪分子不斷變化的策略。

Revolut Faces Scrutiny After Data Breach Fueled by Deceptive Government Impersonation

Revolut 在欺騙性政府假冒導致資料外洩後面臨審查

In a concerning development for fintech giant Revolut, the company has confirmed a significant customer data breach. The incident, which occurred around September 11-12, 2026, was not the result of a traditional hack but rather a sophisticated social engineering attack. Attackers successfully impersonated legitimate government authorities, tricking Revolut into divulging sensitive customer information through fraudulent, yet seemingly official, data requests. This revelation has sent ripples through the industry, raising serious questions about Revolut's security protocols and the broader implications for customer data protection in the digital age.

金融科技巨頭 Revolut 的一項令人擔憂的進展是，該公司已確認發生重大客戶資料外洩事件。這起事件發生在 2026 年 9 月 11 日至 12 日左右，並非傳統駭客攻擊的結果，而是複雜的社會工程攻擊的結果。攻擊者成功地冒充合法政府機構，欺騙 Revolut 透過欺詐性但看似官方的資料請求洩露敏感的客戶資訊。這項消息在整個產業引起了軒然大波，引發了人們對 Revolut 安全協議的嚴重質疑，以及對數位時代客戶資料保護的更廣泛影響。

The Anatomy of the Breach: When a Request Becomes a Weapon

違規剖析：當請求變成武器時

Unlike typical data breaches that involve breaking into servers or exploiting malware, this incident at Revolut exploited a critical weakness in their request-handling process. The attackers did not need to bypass firewalls; they simply asked. By crafting requests that mimicked those from genuine government agencies, they managed to bypass standard security checks. This tactic leverages the trust placed in official communications, a known playbook for cybercriminals that has even been flagged by the FBI in public service announcements regarding the abuse of emergency and official data requests.

與涉及闖入伺服器或利用惡意軟體的典型資料外洩不同，Revolut 的這一事件利用了其請求處理過程中的一個關鍵弱點。攻擊者不需要繞過防火牆；他們只是簡單地問了一句。透過精心設計模仿真正政府機構的請求，他們成功地繞過了標準安全檢查。這種策略利用了對官方通訊的信任，這是網路犯罪分子的一個眾所周知的劇本，聯邦調查局甚至在有關濫用緊急情況和官方資料請求的公共服務公告中對其進行了標記。

The specifics of the impersonated authority, the exact channel of communication, and the precise failure point in Revolut's verification process remain under investigation. However, what is clear is that the data handed over was extensive. Reports indicate that exposed information included identity documents such as passports and driving licenses, selfies used for verification, names, dates of birth, home addresses, email addresses, phone numbers, IBANs, account statements, and crucially, complete transaction histories, including all Bitcoin activity for affected users.

被冒充機構的具體情況、確切的通訊管道以及 Revolut 驗證過程中的確切故障點仍在調查中。然而，可以明確的是，所移交的數據非常廣泛。報告顯示，暴露的資訊包括護照和駕照等身分證件、用於驗證的自拍照、姓名、出生日期、家庭住址、電子郵件地址、電話號碼、IBAN、帳戶報表，以及最重要的完整交易歷史記錄，包括受影響用戶的所有比特幣活動。

Customer Impact and Revolut's Response: What You Need to Know

客戶影響力和 Revolut 的回應：您需要了解的內容

Revolut has stated that systems and customer funds were unaffected, and no account takeovers have been confirmed. However, the exposure of detailed personal and financial data, particularly Bitcoin transaction histories, presents a unique set of risks. This information, when combined with home addresses and identity documents, could potentially be used for targeted phishing attacks, identity theft, or even physical extortion, as seen in previous cases involving crypto-related data leaks.

Revolut 表示系統和客戶資金未受影響，尚未確認任何帳戶被接管。然而，詳細的個人和財務數據，特別是比特幣交易歷史的暴露，帶來了一系列獨特的風險。這些資訊與家庭地址和身分證件結合起來，可能會被用於有針對性的網路釣魚攻擊、身分盜竊，甚至是身體勒索，正如先前涉及加密相關資料外洩的案例中所見。

Revolut has reportedly notified affected customers individually. For those who did not receive a notification, it does not automatically mean their data was untouched. The company advises customers to exercise caution, verify all communications through the Revolut app directly, and consider submitting a Subject Access Request under GDPR Article 15 to obtain definitive proof of what data, if any, was disclosed.

據報道，Revolut 已單獨通知受影響的客戶。對於那些沒有收到通知的人來說，這並不意味著他們的數據沒有受到影響。該公司建議客戶謹慎行事，直接透過 Revolut 應用程式驗證所有通信，並考慮根據 GDPR 第 15 條提交主題存取請求，以獲得披露哪些資料（如果有）的明確證據。

Strengthening Defenses: Lessons from the Revolut Incident

加強防禦：革命事件的教訓

This breach underscores the evolving nature of cyber threats. Relying solely on technical checks like SPF, DKIM, and DMARC is insufficient when attackers gain control of a legitimate email domain. The incident highlights the paramount importance of robust internal verification procedures and human judgment when handling official-looking requests. For customers, the takeaway is clear: be vigilant. Changing passwords may not be effective if credentials were not compromised, but securing accounts with multi-factor authentication, being wary of unsolicited communications, and understanding the implications of leaked financial data are crucial steps.

此次洩漏凸顯了網路威脅不斷變化的性質。當攻擊者獲得合法電子郵件域的控制權時，僅依靠 SPF、DKIM 和 DMARC 等技術檢查是不夠的。這事件凸顯了在處理看似官方的請求時，健全的內部核查程序和人為判斷的重要性。對客戶來說，要點很明確：保持警覺。如果憑證不被洩露，更改密碼可能不會有效，但透過多因素身份驗證保護帳戶、警惕未經請求的通訊以及了解洩露的財務資料的影響是關鍵步驟。

The extensive nature of the data released, particularly the Bitcoin transaction history, serves as a stark reminder of the risks associated with storing sensitive financial information. It encourages a review of how personal and financial data is managed, both by financial institutions and their customers, pushing for greater transparency and more resilient security frameworks in the fintech and crypto spaces. So, while the digital doors might have been tricked open this time, let's hope Revolut and its users can secure the windows and reinforce the foundations for whatever comes next!

所發布資料的廣泛性，特別是比特幣交易歷史，清楚提醒人們儲存敏感金融資訊所帶來的風險。它鼓勵金融機構及其客戶對個人和財務資料的管理方式進行審查，推動金融科技和加密領域提高透明度和更具彈性的安全框架。因此，雖然這次數位門可能被騙開了，但我們希望 Revolut 及其用戶能夠保護窗戶並為接下來發生的事情奠定基礎！