Revolut reported a new leak of customer data belonging to clients who invested in U.S. stocks through the broker DriveWealth. According to the bank, email addresses, phone numbers, mailing addresses, information about place of work, country of citizenship, age, gender, and part of the account number may have been affected.
In a letter from Revolut, it says that the DriveWealth system was breached on September 4–5, and that attackers may have gained access to the data of clients who invested in U.S. stocks through this broker.
The list of affected information includes names, email addresses, phone numbers, mailing addresses, information about place of work, country of citizenship, age, gender, and part of the DriveWealth account number.
Revolut explained that brokerage accounts were opened for clients directly with DriveWealth, while the bank itself only provided trading services. During registration, users agreed to the transfer of personal data to both companies.
The company says the leak may have affected only data that DriveWealth received before December 2023, and after that Revolut moved users from the European Economic Area to another service arrangement.
This is already the second incident involving Revolut customer data in September: at the beginning of the month, the bank said it had itself handed over some users' information to attackers, mistaking a fake request from government agencies for a genuine one. At the time, the company said that the bank's systems and customers' money were not affected, and it did not disclose the number of users impacted.
According to the Financial Times, hackers demanded a three-million-dollar ransom from Revolut and threatened to sell the obtained customer information. The message with the terms, the publication wrote, was posted on one of the websites, and the attackers did not contact the bank directly.
Sources
