Threat Analysis: Revolut Breach via Social Engineering, GitLab Actively Exploited, and What UK SMBs Need to Know
This is your Daily Threat Analysis for the 14th of September 2026.
Two stories today. Both are worth your time. Neither requires a nation-state threat actor or a zero-day exploit to cause serious harm to your business.
Story One: Revolut Breached via Government Impersonation
Revolut has disclosed a data breach. The mechanism is worth sitting with for a moment, because it is not the story the headline implies.
A threat actor impersonated a government agency. Revolut received what appeared to be an official request. Revolut responded to it. Customer financial information and passport data left the building.
No malware. No vulnerability. No sophisticated intrusion. A person, or a process, decided the request was legitimate and acted accordingly.
The disclosure does not state how many customers are affected. That number is currently undisclosed. What is disclosed is the category of data: financial information and passport details. If you are a Revolut customer, that combination, financial data paired with identity documents, is precisely what you need to be concerned about for downstream fraud and identity theft.
The NCSC has published guidance on impersonation attacks and data handling procedures. The fact that a major fintech with significant security resources still had this happen tells you something important: the social engineering problem is not solved by technology alone. It is solved by verification procedures that are followed even when the request sounds plausible, comes from an authoritative source, and creates time pressure.
For UK SMBs, the operational lesson here is direct. Do you have a documented process for responding to data requests from third parties claiming to be government bodies, regulators, or law enforcement? Does every member of staff who handles customer data know what that process is? Does it require out-of-band verification before any data is released?
If the answer to any of those questions is uncertain, that is your action item today, not next quarter, today.
The ICO’s guidance on responding to subject access requests and third-party data disclosures is clear on this. Under UK GDPR, releasing personal data in response to a fraudulent request does not exempt you from liability. The regulator will want to know what verification steps you took. “They said they were from the government” is not a verification step.
Story Two: GitLab Path Traversal Flaw, Actively Exploited, Maximum Severity
CISA has added a GitLab path traversal vulnerability to its Known Exploited Vulnerabilities catalogue. That means it is not theoretical. Attackers are exploiting it in live campaigns right now.
The severity rating is maximum. Path traversal vulnerabilities of this class can allow an attacker to read arbitrary files on the host system, including configuration files, credentials, private keys, and anything else the GitLab process has access to. In a self-hosted GitLab environment, the potential blast radius is significant.
Here is the question UK SMBs need to ask themselves, because most will not be running GitLab directly. Do your software developers use it? Does your web development agency? Does the managed service provider who handles your IT infrastructure? Does any supplier in your technology stack?
If your answer is “I don’t know,” that is your problem. Supply chain exposure through a supplier’s unpatched instance is a known attack vector and has been for years. The advisory attributes active exploitation to this flaw, which means attackers are scanning for exposed instances now.
If you run GitLab self-hosted, patch immediately. If your developers or MSP run it, ask them today to confirm their version and patch status in writing. If you use GitLab.com (the cloud-hosted version), GitLab’s security team handles patching centrally, but it is worth confirming your instance configuration regardless.
The patch has been available. The gap between patch availability and patch deployment is where attackers live.
A Note on the September Windows Updates
One operational item that does not rise to threat level but will cause problems if you patch without awareness: Microsoft’s September 2026 security updates are breaking Remote Desktop Services on Windows Server. If your business relies on RDS, and a significant number of UK SMBs do, particularly those using Windows Server as a remote working solution, be aware that applying this month’s patches may take your remote access capability offline.
Microsoft has confirmed the issue and is working on a fix. The practical question is whether you apply the security patches now and accept the RDS disruption, or delay patching and accept the security exposure. There is no clean answer. What I will say is that the security patches in this release address vulnerabilities that warrant being applied. Plan your patching window accordingly, test in a non-production environment if you have one, and ensure your support provider is aware before you push updates across your fleet.
This is not a reason to skip patching. It is a reason to patch with awareness.
On the Government Passkey Rollout
Also today: the UK government has begun rolling out passkeys for GOV.UK accounts, affecting 23 million users. The stated benefits are fewer phishing headaches and a reduction in the SMS verification bill, reportedly around £600 a day. The move is the right direction. Passkeys are resistant to credential phishing in a way that passwords and SMS OTPs simply are not.
What it is not is a signal that authentication is solved for UK SMBs. The government’s rollout covers its own citizen-facing services. Your business authentication posture remains your responsibility. If you are still relying on SMS-based two-factor authentication as your primary MFA method, the government’s own analysis of why it is moving away from that approach should be instructive.
What To Do Today
Revolut breach / social engineering:
- Review your data disclosure procedures for third-party requests
- Confirm that all staff who handle customer or employee personal data know the verification process
- Ensure out-of-band verification is mandatory before any data leaves your organisation in response to an external request
- If you are a Revolut customer, monitor your accounts and be alert to follow-on phishing attempts using your exposed information
GitLab exploitation:
- If you self-host GitLab, check your version and apply the relevant patch immediately
- If you use a developer, agency, or MSP who may run GitLab, ask them today for written confirmation of their patch status
- If you cannot get confirmation, treat it as unpatched until proved otherwise
September Windows Updates / RDS:
- Alert your IT provider to the RDS issue before patching begins
- Do not skip this month’s patches, plan around the disruption instead
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically. Pass it to someone who could use the heads-up. The colleague who handles your data requests, the developer who manages your repositories, the IT provider who runs your servers, they are exactly the right people to have this in front of them today.
Sources
| Source | Title | URL |
|---|---|---|
| BleepingComputer | Revolut discloses data breach exposing financial info, passports | https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/ |
| BleepingComputer | CISA: Hackers now exploit max severity GitLab flaw in attacks | https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/ |
| BleepingComputer | Microsoft: September updates cause RDS failures on Windows Server | https://www.bleepingcomputer.com/news/microsoft/microsoft-september-updates-cause-rds-failures-on-windows-server/ |
| The Register | UK.gov begins killing off passwords for 23 million users | https://www.theregister.com/security/2026/09/14/ukgov-begins-killing-off-passwords-for-23-million-users/5296088 |
| BleepingComputer | Hackers exploit Tencent app flaw to deploy GrayRabbit malware | https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/ |