Two incidents landed this week with the same weakness underneath them. On September 14, 2026, the ransomware group Booba Project claimed it stole 37 GB of travel arrangement data from Atlas Ocean Voyages. A few days earlier, Revolut confirmed it handed customer records to someone who emailed from a real government agency's domain.
There's no memory corruption bug in either story. No zero-day. In the Revolut case there's no exploit at all, as far as anyone has said publicly.
What Revolut actually gave away
Revolut's statement to The Register says an unauthorized third party "utilised a legitimate government agency domain email to submit fraudulent requests for information." The company detected it, blocked the address, and notified the government agency, law enforcement, data protection authorities, and financial regulators.
The leaked data list is the part that should worry anyone running a KYC pipeline. Per customer notifications shared by ZachXBT and reported by Cointelegraph, exposed records include:
- Passport or driver's license images submitted at registration
- The verification selfie captured through the app
- Full name, date of birth, home and email address, phone number, occupation
- Account statements, IBANs, withdrawal records, and full transaction history, including Bitcoin transactions
Revolut says only a limited number of customers were affected. It hasn't said how many, and confidentiality obligations during an active investigation are the reason given. I'll take that at face value for now, but "limited" is doing a lot of work in a sentence with no number in it.
The attackers have started publishing. Cointelegraph reported on September 14 that identity documents and selfies belonging to named individuals appeared online, including tennis player Alexander Shevchenko and Gamdom CEO Felix Römer. The Telegram posts threaten daily releases until Revolut pays. The demand is 10,000 BTC, which the reporting pegs at over $782 million. Revolut declined to comment on the ransom.
The verification selfie is the real problem
Transaction history is bad. Your IBAN is bad. A live selfie plus a government ID is the full kit for identity theft, and it's the combination most KYC vendors pitch as stronger than either artifact alone.
Liveness checks and selfie-to-document matching exist to stop someone using a stolen passport photo. When both artifacts leak together, already matched and already verified, the attacker doesn't need to bypass that check. They already passed it. Anything downstream that trusts "this person completed KYC" now has a replayable credential sitting on Telegram.
I don't think there's a clean fix at the storage layer. If you keep the selfie, you can lose the selfie. Options are deleting it after verification (fraud teams and regulators both hate this), encrypting it with keys held apart from the rest of the customer record, or accepting the risk. Most fintechs pick the third one because the first two are expensive and the breach hasn't happened yet.
Impersonation is the whole attack
Read Revolut's wording again. "Utilised a legitimate government agency domain email." Not a lookalike domain. The phrasing is slightly ambiguous, but the natural reading is that the mail passed the checks a receiving system would normally apply. SPF, DKIM, and DMARC all pass when the sender controls the domain, or when someone has compromised a mailbox inside it.
This is the boring version of nation-state tradecraft and it works fine against companies. Subpoena-shaped emails arrive, they look right, they come from the right domain, and a compliance engineer processes them. Manual review of a legal request is a human process running at human speed, and the attacker only has to be right once.
Controls that actually reduce this:
Out-of-band verification. Call the agency at a number you looked up independently, not one in the email. Old advice, still the highest-value control on this list.
Two-person approval for any bulk customer data export, with the second approver outside the requester's chain of command. Same team means same assumptions.
Rate limiting and anomaly detection on exports. A single request pulling KYC documents for a thousand accounts should trigger review, not a queue entry.
Logging that survives. If you can't reconstruct which records left which system, when, and under whose credentials, you can't scope a breach. Revolut's "limited number" language suggests they're still counting.
Atlas Ocean Voyages and the other half of the week
The Booba Project claim against Atlas Ocean Voyages is a standard double extortion setup. 37 GB of travel arrangement data, posted September 14, 2026, with the threat actor statement reading "Travel Arrangements Stolen data: 37 GB." Travel bookings are a nasty dataset because they hold passenger names, passport numbers, itineraries, and payment fragments, and customers are frequently in transit when the leak lands. Someone whose flight leaves in six hours is not calling their bank.
Two different attacks, one week, one shared dynamic: the data was already sitting there in a form someone wanted. The 37 GB in that claim is roughly the size of a mid-size booking database export. Compare that to Revolut, where the stolen material may be a few thousand records but each one is individually devastating.
What I'd do this quarter
If you run a system holding identity documents, assume a legitimate-looking request will arrive. Test the process now. Send yourself a fake legal request and watch how far it gets before someone picks up a phone. Most teams find the answer is "all the way to the export button."
Write down the retention period for verification selfies and enforce it. Delete what you don't need. The Revolut attackers are publishing selfies from accounts verified at some point in the past. Data you deleted last year can't be leaked next year.
Then watch the gap between Revolut's public statements and what the attackers publish daily. That gap will tell you more about scope than any press release will.