Revolut Data Breach: Infostealer Credentials and Fake Government Requests

Introduction

An email from an official address can still contain a fraudulent request. The Revolut data breach, disclosed in September 2026, illustrates that risk. Attackers used a legitimate government email channel to impersonate authorities and obtain customer information.

Infostealers can harvest credentials from unmanaged or personal devices, enabling attackers to take over authentic accounts, including government email accounts using Italy’s certified email system, PEC. This explains a potential route to account takeover, rather than a confirmed entry point in this incident.

Revolut acknowledged the impersonation scam and contacted affected customers. The case highlights a practical identity security problem: a trusted sender address does not establish that someone has authority to receive sensitive records.

What happened?

The reported attack involved government email account takeover followed by abuse of a customer-data disclosure workflow. Public evidence does not establish a direct intrusion into Revolut’s internal systems.

These distinctions separate the acknowledged disclosure from claims about targeting, campaign length, and extortion.

Feature Resource

The role of UEM in cyber security

Learn how Unified Endpoint Management helps companies enhance cyber security.

Get the Infographic

How infostealer credentials may have enabled access

Research linked the government account compromise to infostealer malware, which can collect stored login information. However, the infection’s origin remains uncertain. The attackers may have acquired existing stolen credential records rather than directly infecting the government employee.

The reported account-control techniques included adding an attacker-controlled recovery email and deleting messages to conceal activity. These details derive from an attacker-linked account of the campaign, rather than a public forensic report. No verified evidence establishes an MFA bypass or identifies the malware family.

How fake government requests created the disclosure risk

The attackers allegedly used access to an official mailbox to make requests appear authoritative. That distinction matters: authenticating an email’s origin does not validate the sender’s purpose or legal authority.

The available reporting describes data disclosure and extortion. It does not establish ransomware encryption or theft of customer funds.

Why this matters

A financial data breach can begin outside the organization that holds the records. If attackers control a trusted external account, staff may receive convincing requests through familiar channels.

This creates two separate security requirements. Organizations must protect accounts and devices against credential compromise. They must also verify why someone is requesting information and whether the requested disclosure is authorized.

For IT and security teams, the implication is practical: endpoint controls should support a documented approval process. A healthy employee laptop cannot make a fraudulent external request legitimate.

Likewise, protecting the request-handling team’s devices does not secure a government agency’s mailbox. Organizations need independent verification, limited data disclosure, and reviewable approval records alongside technical safeguards.

How Hexnode can help

Hexnode can help reduce opportunities for credential theft by hardening corporate endpoints, enforcing device-aware access, and supporting rapid threat containment.

Hexnode UEM: Reduce infostealer risk before credentials are exposed

Hexnode UEM helps administrators control which applications can run on corporate endpoints. On supported Windows devices, application allowlisting can restrict execution to approved software, helping block unauthorized applications that could carry infostealers. Administrators can also automate supported OS and application updates to close vulnerabilities that malware could exploit.

Through supported Microsoft Entra ID and Okta integrations, administrators can restrict access to protected applications to compliant devices. Compliance requirements can include minimum OS versions, encryption, and application restrictions. The identity provider uses Hexnode’s compliance signals to enforce the configured access policies.

Together, these controls reduce opportunities for malware execution and help keep devices that fail security requirements away from sensitive workflows.

Hexnode XDR: Detect suspicious activity and respond quickly

Hexnode XDR provides threat detection and investigation across Windows and macOS endpoints. Contextualized alerts and endpoint threat hunting help security teams investigate suspicious activity and identify affected devices.

For suspected credential theft, investigation priorities include LSASS memory dumping on Windows and unauthorized access to browser credential or session files. Teams should confirm coverage for these behaviors against their available telemetry and configured detection rules.

Responders can then take one-click actions to kill malicious processes, quarantine files, and isolate affected endpoints. These actions help interrupt malicious activity and contain an infection while the team investigates.

Pair endpoint containment with credential resets, session revocation, and mailbox activity reviews when account compromise is suspected. For sensitive disclosures, retain independent checks of the requester’s authority and the request’s legal basis.

What security teams should do next

The Revolut data breach highlights a gap between trusting a communication channel and authorizing a disclosure. Review the complete request-handling process, including who receives requests, who validates them, and who releases records.

Start by independently confirming the requester through an established contact channel. Require documented approval for sensitive disclosures and release only the information authorized for the request. Preserve requests, verification evidence, and response records.

Next, strengthen accounts used for official correspondence. Deploy phishing-resistant MFA where supported and review recovery settings and account permissions.
If compromise is suspected, coordinate credential resets, session revocation, mailbox review, and endpoint investigation. Hexnode UEM can support device compliance around protected workflows, while Hexnode XDR can support endpoint investigation and containment.

Assign clear ownership across security, legal, and privacy teams. Test the process with a simulated fraudulent request, and fix any step that treats an official email address as sufficient authorization.