September 12, 2026

What happened

CISA added five security flaws affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog after reports of active exploitation in the wild. [1]

The supplied text identifies CVE-2026-42016 as affecting one of the listed products and gives it a CVSS score of 8.1; the description is truncated after stating that it involves incorrect authorization. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation in the wild.

2. [2]

   Details of the vulnerabilities are as follows - CVE-2026-42016 (CVSS score: 8.1) - An incorrect authorization

Read the original article →

What happened

Revolut disclosed sensitive customer data after fulfilling a fraudulent information request sent from an unauthorized account operating within a real government agency’s email domain; the message passed domain-authentication checks. [1] [2] [3] [4] [5] [6]

The exposed information included identity and contact details, identity documents, verification selfies, account statements, withdrawal records, and transaction histories including Bitcoin; no biometric facial telemetry was involved. [6] [7] [8] [9]

Why it matters

The incident did not involve malware, outsider access to Revolut’s servers, or compromised customer funds; staff processed the request, and the fraud was discovered when Revolut independently verified it with the government agency. [10] [11] [12] [13]

Revolut said the incident affected a limited number of customers but did not disclose the scope, agency, country, or market involved. [14] [15]

Researcher ZachXBT assessed that the incident appeared targeted at high-net-worth users; the article reports that the combined data could support fraud, impersonation, or extortion. [16] [17] [18] [19]

Known limitations

The article reports that relying mainly on email authentication can allow an attacker with access to a government domain to bypass checks and obtain sensitive customer data. [20]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Revolut handed over KYC documents, selfies, and Bitcoin transaction histories after a fake government email with valid domain credentials passed its checks.

2. [2]

   Revolut confirmed on September 12, 2026, that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from an email address operating inside an actual government agency’s domain infrastructure.

3. [3]

   The customer notification, which began circulating on September 11, stated that the communication carried valid domain authentication credentials, meaning the email passed the checks that are supposed to confirm a message genuinely comes from a government authority.

4. [4]

   “Revolut received a request for customer information that appeared to come from a legitimate government agency.

5. [5]

   The request came from an unauthorised email account sent directly using the official government agency’s email domain.” reads the Revolut’s notification.

6. [6]

   “As the communication carried valid domain authentication credentials, it was fulfilled under the reasonable belief that it was an authentic government agency request.” “The exposed data included customers’ identity and contact details, including their birth date, postal and email addresses, and phone numbers, as well as copies of their identity documents including passports and driver’s licenses, according to a notification emailed to affected customers and reviewed by TechCrunch.” reported TechCrunch.

7. [7]

   “The data may have also included verification selfies, account statements, and transaction histories, the firm said in its notification.” Multiple outlets including CoinDesk and Crypto Times confirm the transaction histories covered Bitcoin.

8. [8]

   Below are the details of the handed-over data reported in the notification: Identity details: full name, date of birth, occupation Contact details: postal address, email address, and telephone number Document and verification data: a copy of your identity document (passport and/or driver’s licence) and facial verification image (the selfie you provided for verification).

9. [9]

   Please note that no biometric facial telemetry data was involved or compromised Financial data: account statements (including IBAN, account status, opening date, wallet reference number), withdrawal records and full transaction history (including Bitcoin) This is not a technical breach in the usual sense.

10. [10]

    No systems were compromised, no malware was used, and Revolut’s servers were not accessed by an outsider.

11. [11]

    Revolut staff processed it.

12. [12]

    The company only discovered the fraud afterward, by independently contacting the government agency to verify the request, at which point the agency confirmed it had not made it.

13. [13]

    Revolut also says its systems and customer funds were not affected.

14. [14]

    Revolut said that the incident impacted a limited number of customers and immediately contacted them, but did not disclose the scope of the incident.

15. [15]

    Revolut also declined to name the government agency involved or specify whether the breach affected a particular country or market.

16. [16]

    Crypto security researcher ZachXBT, who posted about Revolut’s notification to affected customers, assessed that the incident appeared to be targeted at high-net-worth users.

17. [17]

    pic.twitter.com/wLd3IdmSF9 — ZachXBT (@zachxbt) September 12, 2026 If this assessment is correct, this was not a large-scale data theft.

18. [18]

    It appears to have been a targeted operation aimed at building detailed profiles of wealthy individuals, using their KYC documents and cryptocurrency transaction history linked to their real identities.

19. [19]

    Combined with IBANs and account statements, this information could be very useful for fraud, impersonation, or extortion.

20. [20]

    The incident also highlights weaknesses in fintech data-request processes: relying mainly on email authentication can allow attackers with access to a government domain to bypass checks and obtain sensitive customer data.

Read the original article →