Revolut 数据泄露：虚假政府请求利用安全漏洞，暴露客户数据

最近的 Revolut 数据泄露事件利用了虚假的政府请求，凸显了关键的安全漏洞和网络犯罪分子不断变化的策略。

Revolut Faces Scrutiny After Data Breach Fueled by Deceptive Government Impersonation

Revolut 在欺骗性政府假冒导致数据泄露后面临审查

In a concerning development for fintech giant Revolut, the company has confirmed a significant customer data breach. The incident, which occurred around September 11-12, 2026, was not the result of a traditional hack but rather a sophisticated social engineering attack. Attackers successfully impersonated legitimate government authorities, tricking Revolut into divulging sensitive customer information through fraudulent, yet seemingly official, data requests. This revelation has sent ripples through the industry, raising serious questions about Revolut's security protocols and the broader implications for customer data protection in the digital age.

金融科技巨头 Revolut 的一项令人担忧的进展是，该公司已确认发生重大客户数据泄露事件。该事件发生在 2026 年 9 月 11 日至 12 日左右，并非传统黑客攻击的结果，而是复杂的社会工程攻击的结果。攻击者成功地冒充合法政府机构，欺骗 Revolut 通过欺诈性但看似官方的数据请求泄露敏感的客户信息。这一消息在整个行业引起了轩然大波，引发了人们对 Revolut 安全协议的严重质疑，以及对数字时代客户数据保护的更广泛影响。

The Anatomy of the Breach: When a Request Becomes a Weapon

违规剖析：当请求变成武器时

Unlike typical data breaches that involve breaking into servers or exploiting malware, this incident at Revolut exploited a critical weakness in their request-handling process. The attackers did not need to bypass firewalls; they simply asked. By crafting requests that mimicked those from genuine government agencies, they managed to bypass standard security checks. This tactic leverages the trust placed in official communications, a known playbook for cybercriminals that has even been flagged by the FBI in public service announcements regarding the abuse of emergency and official data requests.

与涉及闯入服务器或利用恶意软件的典型数据泄露不同，Revolut 的这一事件利用了其请求处理过程中的一个关键弱点。攻击者不需要绕过防火墙；他们只是简单地问了一句。通过精心设计模仿真正政府机构的请求，他们成功地绕过了标准安全检查。这种策略利用了对官方通信的信任，这是网络犯罪分子的一个众所周知的剧本，联邦调查局甚至在有关滥用紧急情况和官方数据请求的公共服务公告中对其进行了标记。

The specifics of the impersonated authority, the exact channel of communication, and the precise failure point in Revolut's verification process remain under investigation. However, what is clear is that the data handed over was extensive. Reports indicate that exposed information included identity documents such as passports and driving licenses, selfies used for verification, names, dates of birth, home addresses, email addresses, phone numbers, IBANs, account statements, and crucially, complete transaction histories, including all Bitcoin activity for affected users.

被冒充机构的具体情况、确切的通信渠道以及 Revolut 验证过程中的确切故障点仍在调查中。然而，可以明确的是，所移交的数据非常广泛。报告显示，暴露的信息包括护照和驾驶执照等身份证件、用于验证的自拍照、姓名、出生日期、家庭住址、电子邮件地址、电话号码、IBAN、账户报表，以及最重要的完整交易历史记录，包括受影响用户的所有比特币活动。

Customer Impact and Revolut's Response: What You Need to Know

客户影响和 Revolut 的回应：您需要了解的内容

Revolut has stated that systems and customer funds were unaffected, and no account takeovers have been confirmed. However, the exposure of detailed personal and financial data, particularly Bitcoin transaction histories, presents a unique set of risks. This information, when combined with home addresses and identity documents, could potentially be used for targeted phishing attacks, identity theft, or even physical extortion, as seen in previous cases involving crypto-related data leaks.

Revolut 表示系统和客户资金未受影响，并且尚未确认任何账户被接管。然而，详细的个人和财务数据，特别是比特币交易历史的暴露，带来了一系列独特的风险。这些信息与家庭地址和身份证件结合起来，可能会被用于有针对性的网络钓鱼攻击、身份盗窃，甚至是身体勒索，正如之前涉及加密相关数据泄露的案例中所见。

Revolut has reportedly notified affected customers individually. For those who did not receive a notification, it does not automatically mean their data was untouched. The company advises customers to exercise caution, verify all communications through the Revolut app directly, and consider submitting a Subject Access Request under GDPR Article 15 to obtain definitive proof of what data, if any, was disclosed.

据报道，Revolut 已单独通知受影响的客户。对于那些没有收到通知的人来说，这并不意味着他们的数据没有受到影响。该公司建议客户谨慎行事，直接通过 Revolut 应用程序验证所有通信，并考虑根据 GDPR 第 15 条提交主题访问请求，以获得披露哪些数据（如果有）的明确证据。

Strengthening Defenses: Lessons from the Revolut Incident

加强防御：革命事件的教训

This breach underscores the evolving nature of cyber threats. Relying solely on technical checks like SPF, DKIM, and DMARC is insufficient when attackers gain control of a legitimate email domain. The incident highlights the paramount importance of robust internal verification procedures and human judgment when handling official-looking requests. For customers, the takeaway is clear: be vigilant. Changing passwords may not be effective if credentials were not compromised, but securing accounts with multi-factor authentication, being wary of unsolicited communications, and understanding the implications of leaked financial data are crucial steps.

此次泄露凸显了网络威胁不断变化的性质。当攻击者获得合法电子邮件域的控制权时，仅依靠 SPF、DKIM 和 DMARC 等技术检查是不够的。该事件凸显了在处理看似官方的请求时，健全的内部核查程序和人为判断的重要性。对于客户来说，要点很明确：保持警惕。如果凭证不被泄露，更改密码可能不会有效，但通过多因素身份验证保护帐户、警惕未经请求的通信以及了解泄露的财务数据的影响是关键步骤。

The extensive nature of the data released, particularly the Bitcoin transaction history, serves as a stark reminder of the risks associated with storing sensitive financial information. It encourages a review of how personal and financial data is managed, both by financial institutions and their customers, pushing for greater transparency and more resilient security frameworks in the fintech and crypto spaces. So, while the digital doors might have been tricked open this time, let's hope Revolut and its users can secure the windows and reinforce the foundations for whatever comes next!

所发布数据的广泛性，特别是比特币交易历史，清楚地提醒人们存储敏感金融信息所带来的风险。它鼓励金融机构及其客户对个人和财务数据的管理方式进行审查，推动金融科技和加密领域提高透明度和更具弹性的安全框架。因此，虽然这次数字门可能被骗开了，但我们希望 Revolut 及其用户能够保护窗户并为接下来发生的事情奠定基础！