How inauthentic activity can amplify uncertainty and increase reputational risk
A cyber incident does not end when an organization identifies the technical problem.
Once the incident becomes public, customers, journalists, employees, and investors begin searching for information. During this period of uncertainty, inaccurate claims, misleading interpretations, impersonation attempts, and unrelated stories can quickly enter the conversation.
Bots and other inauthentic accounts can amplify these narratives across platforms, increasing their visibility and making the crisis appear larger, more severe, or more widespread.
The recent Revolut data breach demonstrates how a genuine security incident can create the conditions for a second crisis: an information crisis.
What Happened?
In September 2026, Revolut confirmed that sensitive customer information had been disclosed to an unauthorized third party.
The incident did not result from attackers directly hacking Revolut’s internal systems. Instead, an unauthorized party used a legitimate government-agency email domain to submit fraudulent requests for customer information.
Revolut said the incident affected a “very limited” number of customers. Later reporting indicated that approximately 680 customers may have been affected.
The exposed information reportedly included contact details, dates of birth, addresses, and copies of identity documents. Revolut stated that its internal systems and customer funds remained unaffected.
The company blocked the email address, notified affected customers, and contacted the relevant government agency, law-enforcement authorities, data-protection bodies, and financial regulators.
Sources: Reuters and The Guardian.
The Breach Was Only the Beginning
The confirmed breach created immediate and understandable questions:
- What information was exposed?
- How many customers were affected?
- Were customer funds at risk?
- Had Revolut’s systems been hacked?
- Could criminals use the exposed information for fraud?
These questions created an information gap between what had happened and what the public understood about the incident.
Information gaps are dangerous during a crisis. When verified details are limited, people begin filling those gaps with assumptions, incomplete information, and speculation.
Inauthentic actors can exploit this uncertainty by repeating alarming claims, removing important context, connecting unrelated incidents, or directing customers toward fraudulent accounts and websites.
The breach created the initial risk. Uncertainty created the opportunity for amplification.
How Inauthentic Activity Amplifies a Crisis
Bots and inauthentic accounts do not need to create the original incident to influence the public conversation surrounding it.
They can amplify a crisis by:
- Repeating the same claim at high frequency
- Posting similar messages from multiple accounts
- Moving content across several platforms
- Making limited activity appear like widespread public concern
- Combining confirmed facts with speculation
- Removing context from accurate information
- Reusing older or unrelated incidents
- Keeping a negative narrative active after normal attention declines
- Promoting fake customer-support accounts or fraudulent websites
When people encounter the same claim on several platforms, they may assume that multiple independent sources have confirmed it.
In reality, they may be seeing different versions of the same narrative repeated by connected, automated, or unreliable accounts.
What Shadow Pulse Observed
Shadow Pulse monitored the online conversation surrounding the Revolut incident from September 7 to September 21, 2026.
The analysis examined 651 profiles and identified:
- 114 inorganic users, representing 17.5% of analyzed profiles
- 237 cyborg users, representing 36.5% of analyzed profiles
- 159 posts attributed to inorganic users
Inorganic users displayed automated or bot-like behaviour. Cyborg users demonstrated a combination of human and automated activity.
These findings do not prove that inauthentic accounts caused the crisis, created the original narrative, or participated in a coordinated campaign against Revolut.
They show that inauthentic and partially automated accounts were present in the information environment surrounding a real and sensitive corporate incident.
Their participation can increase repetition, extend the life of a negative story, and make concern appear more widespread.
Profile Composition
Figure 1: Profile composition in the monitored Revolut conversation
Cross-Platform Visibility
The leading Revolut-related highlight appeared in 2,070 posts during the monitoring period.
Among the platforms identified in the Shadow Pulse dashboard:
- X accounted for 699 posts
- Facebook accounted for 578 posts
- News sources accounted for 388 posts
The remaining activity appeared across other monitored sources.
Selected Platform Activity
Figure 2: Posts connected to the leading narrative across selected platforms
The important finding is not only the volume of posts. It is the combination of cross-platform repetition and inauthentic participation.
When the same narrative appears across social media and news environments, it can gain perceived credibility and reach audiences far beyond the customers directly affected by the original incident.
How Confirmed Facts Become Distorted
In the Revolut case, the confirmed facts were specific.
An unauthorized party used a legitimate government-agency email domain to submit fraudulent requests. Revolut disclosed customer information in response to those requests. The company stated that its internal systems and customer funds were unaffected.
As the story moved across platforms, these distinctions could easily disappear.
“Customer information was disclosed after fraudulent requests” may become:
- “Revolut was hacked.”
- “Revolut’s banking system was compromised.”
- “Customer funds are at risk.”
- “All Revolut customers were affected.”
- “Revolut is hiding the scale of the attack.”
These statements do not communicate the same information.
Some may result from misunderstanding. Others may deliberately exaggerate the incident. Repetition can then make distorted versions of the story more visible than the original facts.
Misinformation, Disinformation, and Malinformation
A genuine incident can create several types of information risk.
Misinformation
Misinformation is inaccurate or misleading content shared without an intention to cause harm.
For example, users may incorrectly describe the incident as a direct attack against Revolut’s systems, even though the confirmed breach involved fraudulent information requests.
Disinformation
Disinformation is false or misleading content deliberately distributed to manipulate an audience or damage an organization.
An actor may exaggerate the number of affected customers, falsely claim that customer funds were stolen, or use multiple accounts to make public anger appear larger than it is.
Malinformation
Malinformation uses genuine information in a harmful or misleading way.
An actor may share accurate information about the exposed customer data while removing the context that Revolut’s core systems and customer funds were unaffected. Real details may also be combined with speculation or threatening language to increase fear.
During a fast-moving crisis, audiences may struggle to distinguish between mistakes, incomplete reporting, speculation, and deliberate manipulation.
The Business Consequences
The technical scale of an incident and the reputational scale of the resulting crisis can be very different.
Approximately 680 customers were reportedly affected by the Revolut breach. However, the online conversation surrounding the incident could reach a much larger audience.
Inauthentic amplification can contribute to:
- Loss of customer confidence
- Increased pressure on customer-service teams
- Greater media attention
- More opportunities for fraud and impersonation
- Confusion about which information is accurate
- Increased regulatory and investor scrutiny
- Greater exposure for executives and company representatives
- Long-term damage to brand reputation
The company must therefore manage two connected problems:
- The original security incident
- The information crisis developing around it
Managing the technical incident alone may not be enough to protect customer trust.
Monitoring the Second Crisis
Organizations need visibility into the online environment surrounding an incident.
Monitoring should begin as soon as a sensitive event becomes public and should examine:
- Emerging claims and narratives
- Changes in conversation volume
- Unusual increases in inorganic activity
- Repeated language across multiple accounts
- Movement between social media and news platforms
- Fake customer-service or executive accounts
- Fraudulent links and websites
- Narratives that continue after the main news cycle declines
Early detection helps organizations understand which issues require a response and which narratives may be receiving artificial support.
How Organizations Should Respond
An effective response requires cooperation between cybersecurity, communications, customer service, legal, and leadership teams.
Organizations should:
Establish the facts quickly
Confirm what happened, what information was affected, and which customers require support.
Communicate clearly
Explain the incident in direct language and correct important misunderstandings before they spread.
Monitor narrative changes
Track how the story develops across platforms rather than focusing only on the original announcement.
Detect inorganic amplification
Identify automated, coordinated, or suspicious activity that may be increasing the reach of harmful narratives.
Watch for impersonation and fraud
Look for fake accounts, fraudulent support messages, suspicious links, and websites attempting to exploit public concern.
Prioritize high-risk narratives
Not every negative comment requires a response. Organizations should focus on narratives that are gaining reach, creating customer harm, or influencing media coverage.
The Role of Social Threat Intelligence
Social Threat Intelligence helps organizations understand who is shaping an online conversation, what narratives are spreading, and how those narratives are being amplified.
Shadow Pulse connects content analysis with account behaviour, platform activity, and emerging claims.
This helps organizations:
- Detect high-risk narratives early
- Identify inorganic and partially automated participation
- Monitor cross-platform amplification
- Recognize emerging scams and impersonation attempts
- Separate normal public criticism from suspicious amplification
- Support faster and more informed crisis decisions
The objective is not simply to identify bots or count negative posts.
The objective is to determine whether inauthentic activity is changing the scale, direction, or business impact of a crisis.
Conclusion
The Revolut breach demonstrates how a real security incident can create a much broader information risk.
The breach attracted public attention. Limited information created uncertainty. Inauthentic and partially automated accounts then participated in the surrounding conversation.
These accounts did not necessarily create the original crisis. However, their activity could increase repetition, extend the story’s visibility, and make negative narratives appear more widespread.
Organizations must therefore protect more than their systems and data. They must also understand and manage the information environment that develops around an incident.
A real incident attracts attention. Inauthentic activity can use that attention to increase uncertainty and turn a manageable incident into a wider reputational crisis.