Why the Revolut Hack Matters

Why do major data breaches keep happening—and why do the usual fixes often make the underlying problem worse? Alex and Richard unpack the systemic incentives behind identity-data collection, KYC/AML requirements, and the growing number of organizations storing sensitive personal information. They explore regulatory capture, centralized digital identity, social-engineering attacks, and why simply building “thicker walls” is not enough. The conversation also looks at data minimization, cryptographic identity, decentralization, and how user-controlled systems could reduce both the value of breach targets and the cost of attacks. Timestamps: 00:00 Why data breaches keep happening 01:06 The business of stolen identities 02:07 Why we keep collecting so much personal data 06:32 Scope creep and outsourced verification 08:47 From KYC to “cover your ass” 10:28 How regulatory capture takes hold 14:59 Security as a cat-and-mouse game 16:11 When everyone becomes a data custodian 18:45 The erosion of security standards 23:28 How a “concertina” attack works 25:10 Rethinking the entire system 27:24 Data minimization: collect less 30:53 Cryptographic identity and private keys 33:09 Anonymous, pseudonymous, and public identity 34:45 The limits of centralized digital ID 37:41 Ransomware and denial-of-service risk 39:22 Why brute-force attacks are so cheap 41:33 Designing incentives that punish attacks 43:07 Who really bears the cost of regulation? 44:47 AI, incumbents, and regulatory capture 48:40 How tracking and control became the business model 52:09 What digital surveillance would feel like in real life 53:47 Blockchain, privacy, and public networks 55:00 Changing the economics of tracking