INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Revolut Confirms Data Breach via Fake Government Requests

| 2026-09-14 12:22 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
On September 1, US identity verification provider IDScan.net detected unauthorized access to its systems, which led to a data breach disclosed on September 14. The attackers exploited CVE-2026-72898 in self-hosted tool Metabase to gain access to an internal reporting database of Mathspace, an education platform used by over 1 million people in Australia and New Zealand. Meanwhile, Revolut reported a data exposure after employees responded to fraudulent information requests from a government agency's email account, exposing identity documents, verification selfies, and other sensitive records. The Florida state Department of Motor Vehicles also fell victim to a breach using stolen credentials from a personal device, resulting in the theft of driver records.
Technical Mitigations AI-generated
• Check Point IPS provides protection against this threat (Metabase SQL Injection (CVE-2026-72898)) • Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) • Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters CVE-2026-81963CVE-2026-81963 CVE-2026-85706CVE-2026-85706 CVE-2026-67276CVE-2026-67276 CVE-2026-85046CVE-2026-85046 CVE-2026-72898CVE-2026-72898 CVE-2026-86060CVE-2026-86060 CVE-2026-85880CVE-2026-85880
Target & Sectors
FIVE_EYES FIVE_EYES NORTH_AMERICA NORTH_AMERICA governmentgovernment financefinance educationeducation
Incident Timeline
‎August 2025
Threat actors used phone and text lures to direct employees to lookalike sign-in pages, then register their own authentication methods and collect data from compromised Microsoft 365 accounts.
tactic Ransomware
The report also recorded 1,042 ransomware attacks, almost double the August 2025 figure, while average weekly cyberattacks rose 22% year over year to 2,422 per organization.
financial 1,042 ransomware attacks
The report also recorded 1,042 ransomware attacks, almost double the August 2025 figure, while average weekly cyberattacks rose 22% year over year to 2,422 per organization.
general_metric 22 %
The report also recorded 1,042 ransomware attacks, almost double the August 2025 figure, while average weekly cyberattacks rose 22% year over year to 2,422 per organization.
infrastructure 1,469 compromised devices
The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly $1 million in losses.
financial $1 compromised devices
The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly $1 million in losses.
infrastructure Microsoft 365
Researchers have detected a passkey-themed social engineering campaign targeting Microsoft 365 accounts.
infrastructure Windows
The vulnerabilities were used by multiple espionage groups after Chrome patches became available, allowing browser exploitation, sandbox escape, and privilege escalation on vulnerable Windows devices.
Researchers have detailed BlueMoon, an exploit chain combining two vulnerabilities in Chromium’s V8 JavaScript engine with a Windows flaw to compromise targeted systems.
organisation BlueMoon
Researchers have detailed BlueMoon, an exploit chain combining two vulnerabilities in Chromium’s V8 JavaScript engine with a Windows flaw to compromise targeted systems.
organisation Chromium
Researchers have detailed BlueMoon, an exploit chain combining two vulnerabilities in Chromium’s V8 JavaScript engine with a Windows flaw to compromise targeted systems.
infrastructure Android
Researchers have analyzed an Android banking-fraud campaign by the GoldFactory group that abuses Android Work Profile functionality through a tool called Vwork to clone victims’ banking applications.
organisation GoldFactory
Researchers have analyzed an Android banking-fraud campaign by the GoldFactory group that abuses Android Work Profile functionality through a tool called Vwork to clone victims’ banking applications.
organisation SharePoint
Attackers use phone and text lures directing employees to lookalike sign-in pages, then register their own authentication methods and collect data from SharePoint, OneDrive, and Exchange after gaining access to compromised accounts.
organisation OneDrive
Attackers use phone and text lures directing employees to lookalike sign-in pages, then register their own authentication methods and collect data from SharePoint, OneDrive, and Exchange after gaining access to compromised accounts.
organisation Exchange
Attackers use phone and text lures directing employees to lookalike sign-in pages, then register their own authentication methods and collect data from SharePoint, OneDrive, and Exchange after gaining access to compromised accounts.
‎September 1
Threat actors used unauthorized access to target IDScan.net, a US identity verification provider.
target_region United States
TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1.
tactic Data Breach
TOP ATTACKS AND BREACHES IDScan.net, a US identity verification provider, has disclosed a data breach after detecting unauthorized access on September 1.
‎September 2026
A malicious PyPI package was published and executed by systems, exposing credentials and enabling access to a database.
organisation PyPI
In the most serious case, a model published a malicious PyPI package that was executed by systems, exposing credentials and enabling access to a database. VULNERABILITIES AND PATCHES Microsoft has released its September 2026 Patch Tuesday updates, addressing a record 974 vulnerabilities across its products, including two actively exploited zero-days.
organisation Microsoft
In the most serious case, a model published a malicious PyPI package that was executed by systems, exposing credentials and enabling access to a database. VULNERABILITIES AND PATCHES Microsoft has released its September 2026 Patch Tuesday updates, addressing a record 974 vulnerabilities across its products, including two actively exploited zero-days.
data_breach 974 record vulnerabilities
In the most serious case, a model published a malicious PyPI package that was executed by systems, exposing credentials and enabling access to a database. VULNERABILITIES AND PATCHES Microsoft has released its September 2026 Patch Tuesday updates, addressing a record 974 vulnerabilities across its products, including two actively exploited zero-days.
infrastructure Windows
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
infrastructure 10.0
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
organisation GitLab
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
organisation Community and Enterprise Editions
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
organisation CVSS
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
organisation CVE-2026
CVE-2026-85880 and CVE-2026-81963 both allow local attackers to elevate privileges to SYSTEM, while 20 additional flaws could enable unauthenticated remote code execution without user interaction.
infrastructure 18.7
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
infrastructure 19.3.1
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
infrastructure 19.1.8
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
infrastructure 19.2.6
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
infrastructure 19.3.2
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
organisation Check Point IPS
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
organisation CVE-2026-86060
MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.
organisation MikroTik
MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.
organisation RouterOS
MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.
organisation SSH
MikroTik has fixed CVE-2026-67276 and CVE-2026-86060, RouterOS vulnerabilities that can be chained to obtain passwordless SSH access and elevate privileges to full administrator.
organisation API
The flaw allows unauthenticated attackers to read arbitrary files through the repository commits API.
‎September 12
ZachXBT, an independent crypto-security researcher, publicly disclosed that sensitive user records had been improperly accessed by Revolut on September 11.
‎September 14
A Revolut spokesperson confirmed that an unauthorized third party submitted fraudulent requests for information using a legitimate government agency domain email on September 14.
industry Government
Speaking to Infosecurity on September 14, a Revolut spokesperson said an unauthorized third party submitted “fraudulent requests for information” using a “legitimate government agency domain email.”
‎2026/09/14
Threat actors used valid technical domain authentication to exploit CVE-2026-72898 in self-hosted tool Metabase and access an internal reporting database, which was then fulfilled by Revolut employees as standard legal compliance.
organisation Department of Motor Vehicles
Florida’s state Department of Motor Vehicles fell victim to a data breach after criminals used credentials stolen from a Plant City police officer’s personal device.
organisation Revolut
Revolut has confirmed it has suffered a data breach that has affected customers.
Check Point IPS provides protection against this threat (Metabase SQL Injection (CVE-2026-72898)) Fintech company Revolut has reported a data exposure after employees fulfilled fraudulent information requests sent from an email account within a government agency’s legitimate domain.
organisation Metabase
The attackers exploited CVE-2026-72898 in self-hosted tool Metabase to access an internal reporting database.
organisation Check Point
Check Point IPS provides protection against this threat (Metabase SQL Injection (CVE-2026-72898)) Fintech company Revolut has reported a data exposure after employees fulfilled fraudulent information requests sent from an email account within a government agency’s legitimate domain.
organisation Fintech
Check Point IPS provides protection against this threat (Metabase SQL Injection (CVE-2026-72898)) Fintech company Revolut has reported a data exposure after employees fulfilled fraudulent information requests sent from an email account within a government agency’s legitimate domain.
threat_actor ShinyHunters
The credentials enabled access to driver records, and the ShinyHunters group published images of stolen data.
organisation Check Point Research
AI THREATS Check Point Research has detailed PuzzleMask, a plain-prose prompt technique that hides prohibited instructions from lightweight LLM gatekeepers while allowing stronger target models to recover them.
organisation PuzzleMask
AI THREATS Check Point Research has detailed PuzzleMask, a plain-prose prompt technique that hides prohibited instructions from lightweight LLM gatekeepers while allowing stronger target models to recover them.
organisation LLM
AI THREATS Check Point Research has detailed PuzzleMask, a plain-prose prompt technique that hides prohibited instructions from lightweight LLM gatekeepers while allowing stronger target models to recover them.
organisation Claude
Anthropic has disclosed four incidents in which Claude models operated on the real internet because of configuration failures instead of remaining within intended sandboxes.
organisation DNS
Successful exploitation can give attackers control over exposed routers, enabling configuration changes, DNS manipulation, traffic interception, and use of compromised devices as network footholds THREAT INTELLIGENCE REPORTS Check Point Research has reported that enterprise GenAI usage continued to expand in August, reaching an average of 106 prompts per user, while 86% of organization…
organisation CyberSmart
…ghly sensitive data didn't have sufficiently rigorous verification controls to catch it.” A “Complete Identity Theft Kit”: What Affected Users Must Do Now Jamie Akhtar, CEO and co-founder of CyberSmart, cautioned that, although Revolut said customer funds and its systems were unaffected, the exposed information could still be exploited for identity fraud and highly targeted phishing atta…
organisation vCISO & cybersecurity
Commenting on the breach, Muhammad Yahya Patel, vCISO & cybersecurity advisor at Huntress, noted: “For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high.
organisation Huntress
Commenting on the breach, Muhammad Yahya Patel, vCISO & cybersecurity advisor at Huntress, noted: “For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high.
organisation MFA
He also recommended users of any digital financial services, even those unaffected by this breach, to enable multi-factor authentication (MFA), use unique passwords, monitor accounts and credit reports for unusual activity and report suspected identity misuse promptly.
organisation Shutterstock.com
Image credits: Matthew Nichols1 / WD Stock Photos / Shutterstock.com
Tactical Metrics
Metrics
infrastructure
1,469
Compromised Devices
The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly $1 million in losses.
Metrics
financial
1,000,000
Compromised Devices
The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly $1 million in losses.
Metrics
financial
1,042
Ransomware Attacks
The report also recorded 1,042 ransomware attacks, almost double the August 2025 figure, while average weekly cyberattacks rose 22% year over year to 2,422 per organization.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Researchers have detected a passkey-themed social engineering campaign targeting Microsoft 365 accounts.
Metrics
infrastructure
‎Windows
Affected Product
The vulnerabilities were used by multiple espionage groups after Chrome patches became available, allowing browser exploitation, sandbox escape, and privilege escalation on vulnerable Windows devices.
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
Researchers have detailed BlueMoon, an exploit chain combining two vulnerabilities in Chromium’s V8 JavaScript engine with a Windows flaw to compromise targeted systems.
Metrics
infrastructure
‎10.0
Software Version
Check Point IPS provides protection against this threat (Microsoft Windows Update Stack Elevation of Privilege (CVE-2026-81963)) GitLab has addressed CVE-2026-85706, a critical path traversal vulnerability affecting Community and Enterprise Editions, with a CVSS score of 10.0.
Metrics
infrastructure
‎18.7
Software Version
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Metrics
infrastructure
‎19.3.1
Software Version
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Metrics
infrastructure
‎19.1.8
Software Version
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Metrics
infrastructure
‎19.2.6
Software Version
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Metrics
infrastructure
‎19.3.2
Software Version
Affected versions include 18.7 through 19.3.1, with fixes available in 19.1.8, 19.2.6, and 19.3.2. Check Point IPS provides protection against this threat (GitLab Arbitrary File Read (CVE-2026-85706))
Metrics
infrastructure
‎Android
Affected Product
Researchers have analyzed an Android banking-fraud campaign by the GoldFactory group that abuses Android Work Profile functionality through a tool called Vwork to clone victims’ banking applications.
Metrics
data_breach
974
Record Vulnerabilities
In the most serious case, a model published a malicious PyPI package that was executed by systems, exposing credentials and enabling access to a database. VULNERABILITIES AND PATCHES Microsoft has released its September 2026 Patch Tuesday updates, addressing a record 974 vulnerabilities across its products, including two actively exploited zero-days.
Intelligence Sources
Infosecurity-Magazine 2026-09-14
Check Point Research 2026-09-14