Data can remain useful after a breach while confidence in its custodian becomes harder to justify, changing what businesses must explain and repair.
Data can be lost without going anywhere. Imagine a customer who sends money each month to help her father with his rent. Following a data breach, her bank confirms that her balance is untouched and her account works normally. Yet someone else may now recognise that payment.
The bank retains a useful record but can no longer confine access to its intended recipients. Its continued usefulness does not cancel that loss. Recovery must therefore address what the disclosure enables, alongside the evidence customers and employees need to judge whether the institution’s handling of future requests deserves their confidence.
What remains useful when data escapes?
Revolut’s September 2026 disclosure makes the distinction concrete. The bank said it had supplied customer data in response to fraudulent requests appearing to come from a government agency. Its notification described identity documents, account-verification selfies and transaction histories among the data released, while the bank said its systems and customer funds were unaffected.
For the imagined daughter, an intact balance and an exposed statement have different consequences. Her statement still records a payment accurately; an unauthorised recipient can also quote its date, amount and recipient to make a fraudulent call sound persuasive. The details that help a bank recognise a transaction can help an impostor appear to recognise the customer.
Exposed identity details could also support an attempt to buy goods in someone’s name, leaving that person to dispute the purchase. A different risk arises from publicity about the breach: someone offering to check whether records were leaked, or help remove them, may use the occasion to obtain further personal details without possessing the stolen records at all. Berlin’s public guidance warns about such risks. These are possible consequences, not established outcomes of either incident.
Berlin reveals why recovery cannot be described on a single scale. Two affected Senate departments were back on the state network on 23 August; stolen data was published on 4 September. Reconnection supported administrative work while publication widened access beyond the attackers. An improving service report could therefore sit beside growing exposure.
These are different losses, even when they concern the same record. Its usefulness to the institution may survive even as confidentiality is compromised. Confidence in how the institution handles it then raises a further question, requiring evidence about decisions and safeguards rather than the condition of the record alone.
How does apparent legitimacy become a vulnerability?
The methods matter because the attackers borrowed credibility from arrangements intended to support legitimate cooperation. According to Revolut’s notification, the requests used a government email domain that passed authentication checks. But establishing a message’s apparent source is different from establishing the requester’s entitlement to particular records.
Berlin’s reported method borrowed the appearance of a precaution. YoungData, a portal of Germany’s data-protection authorities, describes a counterfeit ‘prove you are human’ check that apparently induced someone to execute a harmful computer command. In one case, cooperation appeared to answer official authority; in the other, it appeared to satisfy a security requirement.
Neither account establishes employee carelessness or adequate organisational safeguards. The inquiry needs to examine how these signals acquired enough credibility to prompt action, and what would distinguish the next convincing deception from a legitimate request.
If employees no longer know which signals to rely on, routine decisions may acquire new hesitation. That possibility needs investigation; it is not an observed outcome here. Managers should test whether revised checks support sound decisions rather than merely add another approval. Asking everybody to distrust everything is unlikely to improve the morning’s workload.
What can customers reasonably rely on?
Customers and citizens supplied data because an institution needed it to provide a service or perform a public function. They could not inspect every disclosure decision. They may now reasonably ask what makes the next decision safer.
That question remains relevant before fraud is demonstrated or responsibility determined. In a 2023 judgment concerning a separate cyberattack, the EU Court of Justice distinguished these issues: a breach alone does not prove inadequate safeguards, while fear of possible misuse resulting from a GDPR infringement can itself constitute non-material damage. Compensation is not automatic. The distinction matters because neither a presumption of fault nor an absence of financial loss adequately describes the person’s position.
The bank’s customer can still make her transfer, but may now need to question a caller who knows details she thought the bank would keep confidential. An attack that exploited credibility inside an institution can provide material for another deception outside it. Continued usefulness is part of the difficulty: accurate data may serve the bank and make someone else’s story more believable.
A customer at another bank may consequently wonder what her own provider collects and how it handles requests. This is a possible wider effect, not evidence of sector-wide distrust, but managers elsewhere should be prepared to answer those questions.
When is another use worth enabling?
Someone may hope that their medical history contributes to better treatment and still care deeply about keeping it private. Those wishes are entirely compatible. Records created for individual care can reveal patterns no single consultation would uncover. A 2023 OpenSAFELY study, examining prescribing and monitoring in England from September 2019 to September 2021, identified pandemic disruption to some medicine-related blood-test monitoring and substantial recovery by the study’s end.
OpenSAFELY’s arrangement allows approved analyses where patient data is held, without giving researchers unrestricted access to individual histories. Outputs are checked before release, and activity is publicly logged. Trust is supported by limits that continue after admission; credentials are not a key to the whole filing cabinet.
The comparison does not establish that research arrangements are risk-free, or that they can replace every disclosure: an investigation may require identifiable records. It shows that enabling another use need not entail handing over the underlying records. Managers can therefore ask which capability a recipient actually needs, and whether the proposed access grants more.
Consider an open-finance service helping the daughter understand her spending. Her statement may be complete and accurate without explaining whether the payment is an ongoing family commitment or an occasional gift. Asking her supplies something another copy of the record cannot. Conversely, the service may understand the commitment without needing her father’s identity. Preserving confidentiality, preserving context and preserving usefulness therefore require different decisions; collecting more data does not settle all three.
What would make the next decision more dependable?
After a breach, ‘everything is working again’ answers an operational question. Customers also need to understand what failed, what has changed and what remains uncertain. Transparency has substance when an explanation can connect each assurance to a change that has been tested.
For managers, that means being able to answer three connected questions:
What made the original request or action seem legitimate, and what now prevents that signal alone from being sufficient?
What evidence shows the revised process supports sound decisions, including legitimate requests that should proceed?
Which consequences remain beyond the institution’s control, and what practical assistance addresses them?
The answers need not expose security-sensitive details. They should distinguish a revised disclosure check from a promise of greater vigilance, and a blocked access route from copies already released. A specific warning about callers quoting genuine payment details, accompanied by an independent way to verify contact, gives the customer something usable. She cannot audit the bank’s systems; the bank can help her avoid having to judge an unfamiliar caller’s sincerity.
Nor should rebuilding confidence mean returning it to its previous level regardless of the evidence. Candid explanations may reveal limits people had not appreciated. The worthwhile result is confidence proportionate to what the institution can demonstrate, with responsibility for unresolved consequences still visible. A quieter complaints inbox, by itself, says little about either.
Data can continue earning its keep after disclosure while people must reconsider what they can safely rely on. That is why recovery reaches beyond restoring services or reassuring customers: it concerns the conditions under which useful cooperation can continue. The same question belongs in decisions about future sharing, before an incident forces it into view. The daughter can make next month’s transfer. What her bank needs to explain is why entrusting it with the record remains a reasonable thing to do.
Acknowledgements
ChatGPT assisted with source checking, structure, drafting and editing, drawing on the author’s research, conceptual direction, detailed comments and writing guidance.
Dr Laurin Lilly-Laona Friedrichis a Senior Compliance Manager at Lloyds Bank plc’s German branch, with more than a decade of experience spanning financial-services governance, compliance and audit. She holds a PhD in international law and writes about institutional judgment and the human consequences of organisational decisions. She writes in a personal capacity.
References
1. Gatlan, Sergiu. ‘Revolut discloses data breach exposing financial info, passports’. BleepingComputer, 14 September 2026. Includes Revolut’s customer notification and spokesperson’s statement.
3. State of Berlin. ‘Cyberangriff auf das Landesnetz: Informationen für Bürgerinnen und Bürger’. Updated 29 September 2026. Accessed 4 October 2026.
5. Fisher, Louis, et al. ‘Changes in medication safety indicators in England throughout the covid-19 pandemic using OpenSAFELY: population based, retrospective cohort study of 57 million patients using federated analytics’. BMJ Medicine, 2023;2:e000392. DOI: 10.1136/bmjmed-2022-000392. Observation period: 1 September 2019–1 September 2021.
7. Court of Justice of the European Union. Judgment in Case C-340/21, Natsionalna agentsia za prihodite, 14 December 2023. Court press release No 191/23 summarising the judgment.
The European Business Review uses cookies to improve site functionality, provide you with a better browsing experience, and to enable our partners to advertise to you. Detailed information on the use of cookies on this Site, and how you can decline them, is provided in our Privacy Policy and Terms and Conditions. By clicking on the accept button and using this Site, you consent to our Privacy Policy and Terms and Conditions. ACCEPT Reject
Privacy & Cookies Policy
Privacy Overview
This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may have an effect on your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
