Revolut handed data to a fake government request

No exploit, no malware, a request that looked official enough to get answered. Every fintech I work with has an inbox that receives subpoenas, police requests and regulator letters, and almost none of them have a written procedure for verifying who sent one before data goes out the door. I would put that procedure in place this week, with out-of-band verification of the requester and a named person who has to approve disclosure, because auditors rarely probe this and attackers clearly do.

This is the fourth-party problem that vendor questionnaires handle badly. You list your subprocessors, your customer's reviewer ticks the box, and nobody asks what the fulfilment house or the email delivery vendor is doing with customer contact data. Make a short list of vendors that hold your customer identities or email addresses, confirm each one is contractually obliged to notify you fast, and assume any breach there arrives at your customers as a phishing campaign with your name on it.

Plenty of readers have told a US prospect that they moved to passkeys and are therefore phishing-resistant. That claim holds for the authentication step and falls apart at registration and account recovery, which is exactly where these campaigns are aiming. Treat passkey enrolment as a privileged action with a second human involved, and while you are in there, check whether your outbound mail provider lets anyone send as your domain.

Artifactory sits between your developers and your customers, so an authorization flaw there is a path to shipping someone else's code under your name. If you self-host it, this is a same-day job rather than a next-sprint job. A useful side effect: writing "KEV listing triggers emergency patching" into your vulnerability management policy gives you a defensible timeline that auditors and reviewers both accept.

Delaware alone is not going to change anyone's quarter. The pattern is what I would pay attention to: the state obligations you mapped once during SOC 2 prep keep shifting under you, and your US customer contracts usually promise compliance with applicable law rather than with a fixed list. A twice-yearly review of state privacy and notification requirements, owned by someone by name, is cheap insurance against a clause you already signed.