Two weeks ago a Google Cloud outage took down Revolut services, leaving hundreds of thousands of customers temporarily unable to access their money or make card transactions.
The incident capped a tumultuous couple of months for the UK fintech, which also disclosed two separate data security incidents involving Revolut customers in September.
Between 4-5 September unauthorised access to US broker-dealer DriveWealth’s network exposed historical data connected to Revolut customers. A week later, Revolut disclosed that a hacker gained access to a government agency’s systems and used it to send fraudulent requests for information to Revolut.
CISOs and cybersecurity experts who spoke to The Stack said the incidents suggested that even in one of the most highly regulated sectors, where regulatory compliance and sophisticated cybersecurity controls are usually required, resilience still depends on companies' ability to execute cybersecurity strategies and plan for resilience.
While there’s no indication that any of the incidents were connected, the occurrences sharpened a long-standing concern about the fintech sector’s dependence on an interconnected web of financial infrastructure and service providers. Those third parties, as well as the fintechs themselves, also hold sensitive data which make them attractive targets for threat actors.
“The UK has a particularly well-developed regulatory framework for financial services, and institutions invest significantly in security and technology,” said Dr Igor Kotsiuba, assistant professor in finance at Durham University Business School. “Yet disruptions can still occur, even when organisations rely on leading global technology providers.”
