Revolut Data Leak Linked to Compromised Italian Government Accounts
Attackers impersonated law enforcement using breached Italian government infrastructure to access sensitive Revolut customer data.
1Government account breach
Attackers compromised an Italian government PEC account associated with the Prefecture of Reggio Calabria, using the pec.interno.it domain. They impersonated Italian Postal Police officers to send fraudulent requests to Revolut. The attackers exploited the trust in official government communications to obtain sensitive customer data. Revolut confirmed its systems were not breached directly.
2Data exposed
Approximately 680 Revolut customers were affected, with attackers obtaining identity documents, addresses, banking information, and transaction histories including cryptocurrency transactions. The attackers sent transaction identifiers and blockchain deposit addresses to Revolut, requesting information linking these to specific customers. This method was described as a 'spray and pray' strategy, targeting high-value accounts.
3Attack methodology
The attackers used fraudulent European Investigation Orders to request customer information. They allegedly maintained access to Italian law-enforcement systems for six months, exfiltrating 147 GB of data including internal documents and emails. The operation highlights the risk of compromised government infrastructure being used to legitimize fraudulent requests to financial institutions.
4Credibility tactics
Fraudulent communications included a second institutional PEC address in copy, making requests appear more credible. This tactic mimicked normal government office exchanges. Investigators need email headers and PEC logs to determine if the second mailbox was compromised or simply used to reinforce request credibility.
5Security implications
The incident reveals flaws in identity security where technically authentic emails can still be fraudulent. Financial institutions may need additional verification beyond domain checks, assessing requester authority and request patterns. In this case, repeated cryptocurrency transaction requests could have raised red flags for closer scrutiny.
6Unanswered questions
It remains unclear how attackers initially accessed Italian PEC accounts or whether multifactor authentication was enabled. The 147 GB dataset claim requires verification to determine if it represents a broader government infrastructure compromise beyond the Revolut incident. Investigators must establish the scope and timeline of any breaches.
7Broader risks
If confirmed, the 147 GB data leak could include sensitive Italian government operational information beyond just Revolut customer data. The case demonstrates how compromising one trusted organization (government) can enable attacks on others (financial institutions) without direct breaches of the latter's systems.
8Investigative priorities
The primary investigation focus should be on Italian government systems whose identity was allegedly abused, rather than Revolut's infrastructure. Determining whether this was an isolated mailbox compromise or part of a wider intrusion will shape understanding of the attack's scale and potential ongoing risks to institutional systems.