Revolut's Double Breach and the GDPR Carve-Out Nobody Voted On

Week of 28 September 2026 | Compiled by Team Paringa

Two of Europe's most-watched fintechs and platforms had a bad month for data, while Brussels quietly redrew the rules on what counts as "legitimate interest" for AI training.

What Happened This Week

🔴 Revolut's second breach in three weeks — and a $782m extortion demand

Revolut confirmed on 14 September that fraudsters had used a spoofed but technically-authenticated government agency email domain to submit fraudulent data requests, which Revolut's compliance team processed as routine regulatory demands before detecting the scheme. The exposed data reads like a complete identity-theft kit: passports and driver's licences, verification selfies, IBANs, full transaction histories including Bitcoin wallet references, dates of birth, addresses, phone numbers and occupations. Revolut says only "a limited number" of its 80-million-plus customers were affected but has declined to give a figure, market, or department breakdown.

The attackers didn't stop at exfiltration. They posted data samples in Telegram channels and demanded 10,000 Bitcoin — roughly $782 million at current prices — threatening to leak more data daily until Revolut pays. Revolut says it has notified the impersonated government agency, law enforcement, and financial and data protection regulators, and that customer funds and core systems were unaffected.

Eleven days later, on 25 September, The Register reported a second, unrelated incident: attackers used social engineering to breach DriveWealth, the US brokerage that used to provide investment services to Revolut customers, on 4–5 September. This exposed a further tranche of names, emails, phone numbers, addresses, employment data, citizenship, age, gender and partial account numbers from historical Revolut-linked accounts. Neither company has disclosed how many customers were affected, and both declined to answer The Register's questions. Two breaches inside three weeks, hitting the same customer base via two different attack vectors — direct social engineering of Revolut staff, and a third-party vendor relationship — is exactly the pattern regulators use to justify escalated scrutiny.

Sources: The Register | Infosecurity Magazine | The Register

This is the textbook case for tokenisation at ingestion, not after the fact. Revolut's compliance team couldn't tell a forged request from a real one because the underlying PII — passports, IBANs, full transaction history — sat in a form where "valid domain, valid-looking request" was sufficient to release it. If that data had been tokenised at the point of collection, with detokenisation gated behind a verified, auditable regulator identity rather than an email domain, the scam fails at step one regardless of how convincing the forged request looks. We'd advise any client running regulatory-disclosure workflows to treat this as the reference case for testing whether their own request-fulfilment process has the same single point of failure.

🟡 Brussels strips the AI opt-out nobody was told about

The Register reported on 22 September that noyb, the privacy group led by Max Schrems, is escalating its campaign against changes to GDPR Article 88c (now redrafted as Article 88bis) that would let companies invoke "legitimate interest" to process personal data for AI development and training without explicit consent. Schrems called it "digital expropriation of Europeans," arguing member states are now prioritising the profits of "Elon Musk, Marc Zuckerberg, Google or OpenAI" over the fundamental right to data protection.

The mechanics matter: the European Commission's original draft included an unconditional right to object. A leaked Irish Presidency compromise text, dated 3 September, deleted that unconditional opt-out along with data-minimisation and enhanced-transparency safeguards, and instead routes permission through the existing Article 6(1)(f) "balancing test" — the same general-purpose legitimate-interest mechanism controllers already use, and which data protection authorities have repeatedly found is applied too permissively in practice. Germany has since pushed further, proposing that AI training be presumed legitimate interest by default. This is still in Council negotiation, not law — but the direction of travel (weaker AI-specific consent, decades of historical chat and social data back in scope) is the story.

Sources: The Register | ppc.land

Whatever lands in the final text, the direction is unmistakable: "legitimate interest" is becoming the default legal basis AI vendors will lean on, and it's a weaker basis than consent — reversible by regulators, contestable by individuals, and inherently harder to defend in an audit. Clients building or buying AI systems that touch EU personal data should not wait for the Council text to settle; the safer architecture is the one that doesn't need to win the legitimate-interest argument at all, because the training pipeline never touches raw, re-identifiable data in the first place.

🟢 16,000 leaky Supabase databases, discovered the hard way

TechCrunch reported on 25 September that security firm UpGuard identified roughly 16,000 Supabase-hosted databases publicly exposing personal data — names, addresses, phone numbers and passwords — with examples ranging from an Indian adult-streaming platform's private conversations to an African government consulate's records in France and a US valet service's licence-plate data. Supabase CISO Bil Harmer characterised this as a shared-responsibility failure: "We provide secure defaults and tooling, and customers control how their own projects are configured." That's true, and also exactly the problem — developer-platform defaults that are technically secure but practically ignorable at scale.

Sources: TechCrunch

Shared-responsibility disclaimers don't hold up under GDPR or the UK DPA 2018 in front of a regulator — the controller is still the controller, however the platform's marketing describes the split. Any client shipping fast on Postgres-as-a-service platforms should assume default configs will get exploited at scale, and design so that even a fully public, misconfigured database exposes tokens and references rather than usable PII.

What Data Protection Officers Are Dealing With

Two structural pressures are converging on DPOs this quarter. First, the AI-training legitimate-interest carve-out is quietly lowering the bar for what "consent" means in practice across the bloc — DPOs at any organisation feeding data into AI systems now need to document a defensible balancing test, not just point to a checkbox, because the checkbox itself may not exist by the time the Council text lands. Second, the Revolut and Supabase incidents both show that the weak point isn't the primary controller's own systems — it's the vendor relationship (DriveWealth) and the platform default (Supabase) sitting one hop away from the data. DPOs increasingly have to underwrite third-party and platform risk as if it were their own, because regulators and journalists both treat it that way.

Three Things Worth Watching Next Week

1. EDPB fining-methodology consultation — The EDPB's new five-step fining framework and finalised DSA-GDPR guidelines remain open for public consultation until 13 November 2026; expect law firms and industry bodies to weigh in publicly before then.

2. Council trilogue on Article 88bis — Watch for whether Germany's "presumed legitimate interest by default" proposal gains traction, or whether Parliament pushes back on the loss of the unconditional opt-out.

3. Regulatory response to Revolut — Two breaches in three weeks against 80m+ customers is the kind of pattern the ICO and EU counterparts flag for coordinated inquiry; a formal regulatory statement is plausible within weeks.

Could not verify: Exact customer counts for both Revolut incidents remain undisclosed by the company; treat any specific figure circulating elsewhere as unconfirmed until Revolut or a regulator publishes one.

Questions? hello@paringa.ai

Paringa advises infrastructure and security teams on exactly this failure mode — data that's "secure" until a forged request, a vendor relationship, or a platform default proves otherwise. Skyflow's tokenisation approach is one of the few architectures that survives all three. | 28 September 2026 | © Paringa Ltd