Revolut Discloses High-Net-Worth Client Data After Spoofed Government Email Passes Security Checks

This looks eerily like the 2011 RSA SecurID spear-phishing incident, where a single well-crafted email pried open a security linchpin and later enabled the Lockheed Martin breach. Just as Cold-War intelligence agencies exploited trust in diplomatic cables, today’s attackers weaponise the legal rails that post-9/11 anti-money-laundering rules forced banks to build. The episode underlines a 30-year trend: regulators compel ever-bigger honeypots of KYC data, while authentication still hinges on brittle human or email checks. Unless zero-knowledge proofs or self-sovereign identity replace bulk data transfers, each new fintech giant is a future Equifax (2017) waiting to happen. Measured against a 100-year horizon, these leaks chip away at public willingness to centralise identity with private banks—an erosion that could reshape how societies balance surveillance, privacy and financial compliance.