It's that straightforward. Are they all going to pretend they don't know how the data got leaked and that people's right to privacy has been violated?

 According to the reports---  "the attacker used a legitimate government agency email domain to send fraudulent request". Am I the only person who hasn't found any sense in this at all? A legitimate government agency email, but it turns out to be a fraud? So I assume the governments are aware of this whole plot?
That's a new type of stupidity.
Such a terrible abyss.

Speaking of legitimacy--- Yeah I have a LEGIT concern. Why haven't the said email been made public though?

So governments can just make demands of user's personal data's and without explanations of what essence the platforms could just release the user's data's?
I don't want to believe that because they're governments operating in the highest order that they owes us no institution or organization no excuse of their demands.
If that's so then I think it's one of the reasons the Revolut financial service platform fell into the trap of releasing user's documents without being questioned.
Most especially, the blames still goes to the organization for their ignorance of not confirming from the notable and legitimate governments official handle before releasing the information.
Definitely the company will pay for any lost at the course.
This should also teach us more lessons on the essence of making research and confirming its legitimacy before reacting to any so called official demands.

It’s an extremely dangerous data “leak”
Selfies and photos of documents put victims in a terrible and dangerous situation

Thank goodness I don’t have a Revolut account, but they’ve been advertising a lot here in Brazil, there must be plenty of Brazilians using it
My criticism is that governments ask companies to retain the data, companies also want to hold onto that data, and the ones who get screwed are the users, that’s us 

Companies and governments demand it, but offer nothing in return if that information leaks
It’s time to rethink all of this because it’s going to get easier every day to get people’s data

Companies must verify the government first before they send the data even the email looks "real" from the government. They can contact by phone and that doesn't takes too long so they know that is real or fake.

And the government must clarify this because customers can lose trust to them but customers can't do anything because their data has been moves to the fake government official.

This is a case of common negligence. It is reasonable to assume that, and it can be assumed that, whoever transmitted this confidential data is directly related to those who allegedly forwarded such a letter upon request. Everything is bought, and everything is sold. There's always someone you can buy. This appears to be an orchestrated incident, when one sends and the other passes, and they get away with it. If such stories are not isolated, then the company is obliged to review its staff and not only pay fines but also punish direct participants who are so negligent about fulfilling their duties.

There is a way to protect your privacy should something like this happen - by requesting the cancellation of your old documents and the issuance of new ones. That naturally comes at a price, but it can be done. What's a little more difficult is changing your address or name, but there are people who will do that if they feel threatened.

The key thing is that you should not trust anyone when it comes to your documents, especially private companies like Revolut or any CEX. Criminals are looking for every possible way to get hold of information about people who trade or own cryptocurrencies, and that is why it is necessary to start using decentralized services that do not require KYC.

There are ways to do that but these methods are only helpful for you in your homeland. I am not quite sure that if you request a new identity card, a new passport from your government, and consequently previous one will be cancelled and become invalid, these leaked documents will still be able to use by other people.

They can do things like using such identity documents for opening and verifying accounts on centralized exchanges. You can not control that and exchanges will possibly approve those registrations and KYC with your old documents. Exception is if you already had accounts on those exchanges, and exchanges detect overlap among documents and refuse later accounts use your documents, even old version.

I agree with you.

I know there is thing like Right to be forgotten, but as you said, we can not trust anyone, any entity about that. We can send a forgotten request, they approve that, but who knows what they do after sending an approval email to us.

Art. 17 GDPRRight to erasure (‘right to be forgotten’).
Right to be forgotten.

They demanded data of high valued users. How did scammers know about them in the first place as well? Maybe they already cross referenced this all from the previous breaches, like from Trezor, etc. Then chose some names on the basis of some other metrics and then hacked the email to request the data.

But even for a second, if I imagine I am a hacker, what's the chance that after hacking the email I could get data like this? So this shows they were not hacking email for this purpose. They hacked it for other reasons. They just happened to see the exchange of data between them, and they used this opportunity quickly and got the data of many high valued customers, who have been notified by the emails as well.

It's always a case of taking medication after the headache has subsided. This has been happening lately under companies many of us have never heard of or have heard of but is still a new platform with customers that think they are genuine and trustworthy enough to keep their data safe.

I mean, almost same issue happened when Google leaked users data and as old as they have been in the he business they didn't see it coming, let alone newer CEX with kyc requirements and customer database that have no experience or have learnt from the experience of others about how data breach could occur and gave an already safe proof mechanism in place.

This isn't money that got stolen, but real identities of individuals that could be sold on the dark web to the highest bidder and it can't be changed or repaid or reclaimed because a persons identity is what they bear for a life time.

Checks and verification proof has to always be ensured in proper by these crypto KYC platforms to avoid such every happening, mostly when those requesting are so humble in their request or stern and with proper documentation. Still do a background check directly from the source to confirm the request always.