The Italian government never asked for this data. Its email address did.

On 12 September 2026, Revolut, the London-headquartered digital banking and cryptocurrency platform used across Europe, disclosed that an unauthorised third party had obtained sensitive customer data by impersonating a government agency over email. The company described the incident as a sophisticated external impersonation scam in which someone used a legitimate government domain address to submit fraudulent requests for information, and Revolut, believing the requests genuine, answered them.

Cybersecurity firm Hudson Rock later traced the fraudulent requests to a compromised email account inside the Italian Ministry of the Interior's certified messaging system, the network Italian public bodies use to exchange official correspondence with outside organisations. Investigators identified more than 300 compromised credentials tied to that domain, most likely sourced from infostealer malware logs traded on criminal marketplaces rather than obtained through a direct intrusion into the ministry itself. Whoever sent the requests did not need to breach Revolut's systems. They needed only an inbox Revolut had no reason to distrust.

Over roughly five to six months, the attacker used that access to submit requests that read as routine official correspondence, and Revolut fulfilled them under the reasonable belief that it was dealing with a genuine government authority. Around 680 accounts were affected, reportedly concentrated among the platform's higher-net-worth customers and cryptocurrency holders. The data handed over included passports and driving licences, identity verification selfies, dates of birth and occupations, full contact details, account statements listing IBANs, and complete transaction histories spanning both currency and cryptocurrency transfers.

The campaign reportedly did not stop at Revolut. The same operation is said to have pulled more than 147 gigabytes of data from Italian law enforcement systems, and on 17 September a threat actor using the alias IAmNotAVillain publicly demanded three million dollars for the stolen material. Revolut has stated it received no direct ransom contact and has declined to name the agency it believed it was corresponding with, or to confirm the full scope of customers affected. The company maintains that its own systems and customer funds were never at risk, only the request channel was.

The defences that failed here were not weak by conventional standards. Revolut runs one of the more sophisticated identity and fraud stacks in consumer fintech, and the request that unlocked this data did not exploit some overlooked side door. It arrived from a domain address that authentication protocols such as DMARC, DKIM and SPF are specifically designed to vouch for, and those protocols worked exactly as intended: they confirmed the email had genuinely come from that government domain. What they could not confirm was that a real, authorised person at that agency, rather than someone holding a stolen mailbox, had actually written it. That gap sits underneath every organisation that treats a verified sending domain as proof of a verified human.

This is precisely the execution event GoFirm's control exists for. A request to export or hand over regulated customer data on the strength of a government authority's say-so is a high-impact action, not routine correspondence, and treating it as routine is where the process broke down. Before such a request can be actioned, GoFirm sends a real-time push notification to the named authority's own registered device, not to the inbox the request arrived from, requiring biometric confirmation that they personally authorised it.

A compromised government mailbox, however official its domain looks in the sender field, cannot produce a fingerprint or face match on a device it does not hold. The execution boundary holds regardless of how credible the request appears.

GoFirm is The Authority Platform. Stop unauthorised action. Every time.

In association with Osinto.ai, the collective intelligence and governance network for Security, Resilience & Defence teams.

References

1. Singh, J. 2026. Revolut confirms customer data breach through fake government requests. TechCrunch, 12 September 2026. https://www.google.com/url?q=https://techcrunch.com/2026/09/12/revolut-confirms-customer-data-breach-through-fake-government-requests/&source=gmail&ust=1789987915008000&sa=E
2. Gatlan, S. 2026. Revolut discloses data breach exposing financial info, passports. BleepingComputer, 14 September 2026. https://www.google.com/url?q=https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/&source=gmail&ust=1789987915008000&sa=E
3. Arghire, I. 2026. Revolut data breach: 5 months, 680 high-profile accounts, $3M ransom. SecurityWeek, 17 September 2026. https://www.google.com/url?q=https://www.securityweek.com/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/&source=gmail&ust=1789987915008000&sa=E