Revolut says customer passports and selfies exposed via fake government email

This matters less as a Revolut-specific event than as a reminder that KYC data — passports, selfies, transaction histories — is only as secure as the humans and inboxes handling it, not the blockchain or ledger underneath. The exposure came through social engineering against a government domain, which is a channel every regulated crypto and RWA platform depends on for verification and enforcement. The open question is whether disclosure practices around such incidents keep pace with how much sensitive identity data these firms now hold.