Italian Government Email Hack Exposes Data on 680 Revolut Users

A suspected compromise of an Italian government certified email (PEC) account may have enabled attackers to impersonate law enforcement and obtain sensitive information on about 680 Revolut customers, according to the Financial Times as cited by Security Affairs. Revolut said its own systems were not breached, but that it received fraudulent requests apparently sent from a legitimate Italian government domain, `pec.interno.it`. The account was reportedly associated with the Prefecture of Reggio Calabria and was allegedly used by people posing as Italian Postal Police officers.

The requests reportedly included cryptocurrency transaction identifiers and blockchain deposit addresses, and sought information linking them to specific customers. Researcher Korra of Duel said the attackers used a “spray and pray” approach, submitting hundreds of identifiers and allegedly using fraudulent European Investigation Orders.

The information reportedly obtained included identity documents, addresses, banking details, account statements, verification selfies and transaction histories, including cryptocurrency transactions. The report says a second institutional PEC address was copied into at least one request, potentially making it appear more credible. Original email headers, PEC logs and authentication records may help establish whether one or more government accounts were taken over.

A threat actor calling itself IAmNotAVillain claims it had access to several Italian law-enforcement departments for about six months and stole approximately 147 GB of data, including documents, emails, calendars and personal information. That claim has not been independently verified. The article says it is also unclear how the PEC accounts were compromised, whether multifactor authentication was enabled, or whether credentials, session tokens or other authentication material were stolen. The confirmed element is the alleged exposure through fraudulent requests; the wider compromise remains under investigation.