# Revolut Data Leak Linked to Compromised Italian Government Accounts Attackers impersonated law enforcement using breached Italian government infrastructure to access sensitive Revolut customer data. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-09-16 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/99f97aae-0c15-40a7-ac3b-77aa1f92dfce ## Government account breach Attackers compromised an Italian government PEC account associated with the Prefecture of Reggio Calabria, using the pec.interno.it domain. They impersonated Italian Postal Police officers to send fraudulent requests to Revolut. The attackers exploited the trust in official government communications to obtain sensitive customer data. Revolut confirmed its systems were not breached directly. ## Data exposed Approximately 680 Revolut customers were affected, with attackers obtaining identity documents, addresses, banking information, and transaction histories including cryptocurrency transactions. The attackers sent transaction identifiers and blockchain deposit addresses to Revolut, requesting information linking these to specific customers. This method was described as a 'spray and pray' strategy, targeting high-value accounts. ## Attack methodology The attackers used fraudulent European Investigation Orders to request customer information. They allegedly maintained access to Italian law-enforcement systems for six months, exfiltrating 147 GB of data including internal documents and emails. The operation highlights the risk of compromised government infrastructure being used to legitimize fraudulent requests to financial institutions. ## Credibility tactics Fraudulent communications included a second institutional PEC address in copy, making requests appear more credible. This tactic mimicked normal government office exchanges. Investigators need email headers and PEC logs to determine if the second mailbox was compromised or simply used to reinforce request credibility. ## Security implications The incident reveals flaws in identity security where technically authentic emails can still be fraudulent. Financial institutions may need additional verification beyond domain checks, assessing requester authority and request patterns. In this case, repeated cryptocurrency transaction requests could have raised red flags for closer scrutiny. ## Unanswered questions It remains unclear how attackers initially accessed Italian PEC accounts or whether multifactor authentication was enabled. The 147 GB dataset claim requires verification to determine if it represents a broader government infrastructure compromise beyond the Revolut incident. Investigators must establish the scope and timeline of any breaches. ## Broader risks If confirmed, the 147 GB data leak could include sensitive Italian government operational information beyond just Revolut customer data. The case demonstrates how compromising one trusted organization (government) can enable attacks on others (financial institutions) without direct breaches of the latter's systems. ## Investigative priorities The primary investigation focus should be on Italian government systems whose identity was allegedly abused, rather than Revolut's infrastructure. Determining whether this was an isolated mailbox compromise or part of a wider intrusion will shape understanding of the attack's scale and potential ongoing risks to institutional systems. ## Sources covering this story - https://securityaffairs.com/199180/data-breach/revolut-data-leak-may-trace-back-to-compromised-italian-government-accounts.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._