Revolut disclosed sensitive information on around 680 customers after fraudsters submitted information requests through what turned out to be a certified Italian government email account, or PEC, linked to the Prefecture of Reggio Calabria. The requests carried valid domain authentication and were signed as coming from Italy’s Postal Police, and Revolut’s staff processed them as routine legal-compliance requests, according to Infosecurity Magazine and TechCrunch, which both reviewed Revolut’s customer notification.
Revolut, which confirmed the breach on 12 September, calls it “a sophisticated external impersonation scam.” It says its own systems and customer funds were untouched. The 680 figure comes from the Financial Times; Revolut itself has only ever called the group affected “limited.”
The requests came from an account under the government’s pec.interno.it domain, tied to the Reggio Calabria Prefecture, but signed by the Postal Police, which normally has its own certified mailboxes. They also lacked the judicial authorisation that would usually accompany a police data request. Italy’s Postal Police has opened a criminal investigation into suspected unauthorised access to a computer system, and Reggio Calabria prosecutors are doing the same. Investigators haven’t established whether the mailbox was breached or cloned, and the Prefecture has denied sending the requests.
A group calling itself iamnotavillain has since claimed responsibility, telling the Financial Times it compromised the Italian government mail system and used it to pose as law enforcement for several months, targeting customers with large cryptocurrency holdings identified through blockchain analysis. The group says it holds around 147GB of data.
On 17 September, iamnotavillain published a public ransom demand: 6,000 Monero, worth roughly $3 million, with a 24-hour countdown and a threat to sell the data if Revolut doesn’t pay. That’s unusual — demands like this are normally made privately, with a public leak only as a last resort. Revolut says it has had no direct contact from the group.
Data disclosed reportedly includes names, dates of birth, postal and email addresses, phone numbers, passport and driving licence copies, verification selfies, account statements, IBANs, withdrawal records and full transaction histories, including Bitcoin activity. Britain’s Information Commissioner’s Office is looking into the incident.
Italy’s data protection authority, the Garante, has separately opened checks into how Italian banks authenticate and process access requests, contacting data-protection officers at banking institutions directly. It has also exchanged information with its Lithuanian counterpart, reflecting Revolut’s principal EU establishment, and is in contact with Italy’s Interior Ministry over whether other financial institutions received similar fraudulent requests.
For anyone working in email authentication, the case is a clean illustration of a gap SPF, DKIM and DMARC were never built to close. Those protocols confirm a message came from infrastructure authorised to send on behalf of a domain. They say nothing about whether the person using that infrastructure inside it is authorised to make the request.
