Published Sunday, September 20, 2026 at 05:43 AM PT
BLUF: Revolut has confirmed a breach in which a threat actor impersonating a government agency exploited an email address on an official agency domain to obtain sensitive customer records. Separately, Cisco has released patches for an exploited email gateway zero-day. Both incidents are active; no timeline provided for Revolut’s data exposure window or full victim count.
DETAILS:
- Revolut breach confirmed: An attacker impersonating a government agency used a spoofed or compromised email on that agency’s official domain to social-engineer sensitive data from Revolut. The bank publicly confirmed the incident; date of breach discovery not specified in available reporting.
- Attack vector: Email domain impersonation — threat actor leveraged apparent government authority to gain customer trust and access.
- Cisco email gateway 0-day: Cisco has released patches for an email gateway vulnerability being actively exploited in the wild. No CVE details, attack scope, or affected product line provided in available material.
- Status: Both incidents appear recent; Revolut breach announcement timing unclear (noted “Saturday” but no date provided). Cisco patch status unknown (released/pending).
IMPACT:
- Revolut: Scope of exposed data undefined. Customer records accessed; type/volume unknown. Customers of the platform; European financial institution with multi-million-user base.
- Cisco: Email gateway appliances worldwide. Organizations running affected Cisco email security products. Potential for mass exploitation if patch adoption is slow.
RECOMMENDED ACTIONS:
- Revolut customers: Monitor accounts for unauthorized activity and fraud; consider credit monitoring if financial data was exposed.
- Cisco customers: Identify affected email gateway appliances immediately and apply patches as soon as tested. Do not delay; active exploitation is in progress.
- Organizations: Review email authentication (SPF, DKIM, DMARC) to detect domain spoofing attempts. Audit recent email-based social engineering reports.
SOURCES: Help Net Security week-in-review digest (date of publication not provided in excerpt). Full reporting incomplete — details fragmentary and timing unclear. Status: unconfirmed pending original Help Net Security article.
Recent high-severity events at publish time:
