Revolut Sent Data to an Impostor, Plus 4 Tech Stories
Revolut gave customer data to somebody posing as a government agency
Revolut says it disclosed sensitive customer information to an unauthorized third party after fraudulent requests arrived from an email address on a legitimate government-agency domain. That makes this an unusual Revolut data breach. According to Revolut, nobody broke into its systems and customer funds weren’t touched. The attacker appears to have beaten the process that decides whether a request for private records is legitimate.
That can be every bit as damaging to the people whose records were handed over.
Reuters reports that the exposed information included dates of birth, postal and email addresses, phone numbers, and copies of identity documents such as passports and driver’s licenses. The Block, citing a notice sent to affected customers, says some disclosures may also have included verification selfies, account statements, IBANs, withdrawal records, and full transaction histories, including Bitcoin transactions. Revolut says a limited number of customers were affected but hasn’t said how many or identified the government agency whose domain was used.
This is a useful reminder that “official-looking” and “authenticated” are not the same thing. If a company is going to release passport copies, bank records, or years of transaction history because somebody asks from a government email address, the email address can’t be the end of the verification process. High-risk requests need a second channel: a known telephone number, a pre-established government portal, a second authorized contact, or some other way to prove the request is real.
For affected Revolut customers, the immediate problem is targeted impersonation. A scammer who knows your address, phone number, identity-document details and transaction history can write a phishing message that looks considerably more believable than “Dear Valued Customer.” Revolut says passcodes and customer funds weren’t compromised, so there isn’t evidence here that everybody needs to replace a passport or reset every account. But a message that already knows intimate details about your banking activity deserves more skepticism, not less.
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
BlueMoon shows why three separate patches can be one attack
We covered the underlying Chrome and Windows zero-days separately this week. Proofpoint has now shown what happens when an attacker puts them together.
The BlueMoon exploit kit chains CVE-2026-85046, a type-confusion bug in Chromium’s V8 JavaScript engine, with CVE-2026-87491, a V8 sandbox escape, and CVE-2026-85880, a Windows kernel privilege-escalation flaw. In plain English, one bug helps malicious web content get code running, another helps that code escape the browser’s containment, and the Windows flaw helps it gain much more powerful access to the machine.
Proofpoint says it first saw the China-aligned TA412 group using BlueMoon on August 28. Within days, three other espionage-oriented clusters had adopted it. That’s the part worth noticing. A vulnerability doesn’t exist in a neat little box labeled “browser problem” or “Windows problem” once somebody builds a chain. Attackers assemble whatever pieces get them from a web page to the level of access they actually want.
The Chrome flaws and the Windows flaw have now been patched. So the practical advice is boring, which is good: update Chromium-based browsers, actually relaunch them, install Windows security updates, and make sure managed machines really received both. Proofpoint saw signs consistent with AI-assisted development of BlueMoon, but says no single artifact proves it. That’s the right level of confidence. We don’t need an AI angle to make an exploit chain involving three already-exploited zero-days interesting.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Europe’s Cyber Resilience Act reporting clock is running
A quieter deadline passed Friday that matters to companies making software and connected devices for the European market. The European Union’s Cyber Resilience Act now requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents.
The first deadline is fast: an early warning within 24 hours of becoming aware of the problem, followed by a fuller notification within 72 hours through ENISA’s new Single Reporting Platform. Final reporting comes later. Most of the CRA’s broader product-security requirements don’t become applicable until December 2027, which makes this easy to misunderstand as a future compliance problem. The reporting obligation is not future tense anymore.
For a small software or hardware company selling into Europe, the practical job is less glamorous than the regulation’s name suggests. Somebody needs to know whether the product is in scope, who has authority to declare an incident reportable, who starts the 24-hour clock, and who actually files the notification. A security mailbox that eventually gets reviewed is not an incident process.
For smaller firms, the important distinction is between the reporting rule that applies now and the broader product-security requirements that follow in December 2027. The sensible preparation is an escalation path short enough to work at 2 a.m., not a compliance document nobody can find when the clock starts.
South Korea is treating technology theft more like espionage
South Korea’s expanded espionage law takes effect today, and the reason belongs in a technology brief. Until now, the country’s espionage provisions generally centered on acts benefiting an “enemy state,” which in practice meant North Korea. Cases involving other countries or companies often had to be pursued under industrial-technology or trade-secret laws instead.
The revised law creates an espionage offense for activity benefiting any foreign country or equivalent organization, with a minimum three-year prison sentence. South Korea’s National Intelligence Service says the change will help protect strategic technologies including semiconductors, displays, batteries and AI.
That tells us something about how governments now see technology competition. A stolen manufacturing process or chip design isn’t necessarily being treated as ordinary corporate theft anymore. In strategically important industries, the line between trade-secret theft and national-security espionage is getting thinner.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
NASA’s Moon model is AI doing a specific job
NASA and IBM have released an open-source Lunar Foundation Model trained primarily on data from the Lunar Reconnaissance Orbiter. The training set includes roughly two million image tiles, plus data from missions including GRAIL, Lunar Prospector and Japan’s SELENE mission.
A foundation model here doesn’t mean a chatbot that happens to know a lot about the Moon. It’s a model pre-trained on a large scientific dataset so researchers can adapt it to narrower jobs without starting from zero. NASA says scientists can fine-tune it for crater mapping, identifying unusual volcanic features, detecting surface changes and estimating where ice may remain stable near the lunar poles.
Across NASA’s evaluations, the model matched or beat strong baseline models on the tested tasks and showed a clear advantage on polar-ice stability estimates. The model, code, training datasets and benchmarks are being released openly through Hugging Face, GitHub and NASA’s research ecosystem.
The interesting part isn’t that NASA found a reason to put “AI” in a press release. It’s that this is exactly the sort of problem machine learning is good at: an enormous, messy collection of observations that humans understand but can’t practically inspect one image tile at a time. No robot scientist. No magical discovery button. Just a tool that can help researchers spend less time finding the crater and more time figuring out why it matters.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Reuters: Revolut confirms sensitive customer data breach after fake government requests
- The Block: Revolut customer KYC and transaction data exposure
- Proofpoint: BlueMoon exploit chain
- European Commission: Cyber Resilience Act reporting obligations
- ENISA: CRA Single Reporting Platform launch
- Reuters: South Korea’s expanded espionage law takes effect
- NASA: Lunar Foundation Model
- IBM Research: NASA-IBM Lunar Foundation Model
