Fintech company Revolut plagued by security issues

LONDON – It’s been a tough week for global neobank and fintech company Revolut as it deals with the fallout of both a system flaw and cybersecurity data breach.

A flaw in the banking entity’s U.S. payment system allowed criminals to steal as much as $20 million in funds over a span of several months in 2022. According to reporting by the Financial Times the incident has yet to be publicly disclosed and is the latest setback for the company as it struggles to obtain its banking license in the U.K. The company has also seen a number of high-profile departures in recent months including CFO Mikko Salovaara in May this year for “personal reasons” after just two years in the position.

“Financial organizations tend to be mature when it comes to security. However, as this incident shows, vulnerabilities or gaps in controls and processes can still occur,” security researcher and Picus Security co-founder Dr. Suleyman Ozarslan wrote in an emailed statement to Security Systems News. “It may be the case that no single department bears ultimate responsibility for the financial loss. The IT and cybersecurity department might have prevented this by regularly checking for logical vulnerabilities in its system. The Finance department could have identified the discrepancy in the transactions sooner.

Suleyman added that while there are preventative measures that companies can employ, “This is not a typical cybercrime story of a data breach or ransomware campaign, but strengthening security systems and implementing advanced fraud detection techniques can prevent these incidents.”

Regrettably for Revolut the company has also felt the sting of a recent data breach. Just this week a pair of teenagers associated with the hacking group Lapsus$ str being prosecuted in a London court for their role in hacking and blacking mailing Uber, video game developer Rockstar, and Revolut among others. The hack exposed the information of roughly 5,000 Revolut customers.

Security Systems News reached out to Revolut but the company declined to comment, clarifying that the two incidents mentioned above were unrelated.