Revolut's US Partner Hit by Social Engineering Attack Exposing Customer Data

British digital bank Revolut disclosed two customer data breaches after its former US brokerage partner DriveWealth suffered a social engineering attack on September 4-5. The attacker gained unauthorized access to information including names, email addresses, ages, gender, nationality, mailing addresses, and employment details.

The compromised records are older customer profiles that do not include records of European Economic Area users after 2023. DriveWealth previously handled US stock trading operations for Revolut's users.

The attacker initially demanded up to $760 million in Bitcoin before lowering the demand to $3 million in Monero and leaking files linked to 680 crypto investor accounts, including those of public figures such as Mark Karpelès, former CEO of the Mt. Gox exchange.