preferred on
Points of Focus
- Hackers allegedly exploited a compromised Italian government email account to impersonate law enforcement and obtain sensitive data on roughly 680 Revolut customers.
- The attackers reportedly used blockchain analysis to identify high-value crypto holders, potentially linking onchain activity with passports, addresses and transaction histories.
- The group later demanded 6,000 XMR, worth about $3 million, although Revolut said it received no direct ransom demand and its core systems were not breached.
The hackers who extracted sensitive data on roughly 680 Revolut customers did not need to break into the fintech’s banking infrastructure.
Instead, they appear to have exploited something potentially more powerful: Revolut’s trust in a government email account.
Over several months, attackers posing as Italian law enforcement allegedly submitted requests for customer information through a legitimate Italian government email domain. Revolut processed the requests as genuine legal demands, exposing identity documents, addresses, bank details and transaction histories of hundreds of customers.
‼️ BREAKING: We're in contact with the Revolut hacker. According to them, they didn't only take Revolut data, they've also compromised multiple Italian law enforcement departments.
They say the operation targeting Revolut ran for six months, and that they used Italian law… pic.twitter.com/ZYGWZEc0tL
— International Cyber Digest (@IntCyberDigest) September 14, 2026
The attackers then allegedly used the stolen information to target cryptocurrency holders before demanding a $3 million ransom payable in privacy-focused cryptocurrency Monero (XMR).
The breach has now escalated into an extortion campaign. A group calling itself “iamnotavillain” has launched a website advertising the stolen data, reportedly threatening to sell or expose information belonging to roughly 680 customers if Revolut does not pay.
UPDATE: 🚨 A hacker claiming responsibility for the Revolut data breach has launched a website advertising the stolen data and is demanding a ransom, while reportedly blackmailing people whose data was included. pic.twitter.com/O7r9j3YYYb
— CoinMarketCap (@CoinMarketCap) September 17, 2026
The case shows how attackers can potentially combine government identity infrastructure, financial compliance systems and public blockchain intelligence without directly compromising a bank’s core systems.
Revolut Attack Started With Italy’s Government Email System
At the center of the investigation is Italy’s Posta Elettronica Certificata (PEC) system, a certified email infrastructure used for legally recognized communications.
Italian reporting has linked the fraudulent requests to a PEC account associated with the Prefecture of Reggio Calabria, part of Italy’s Interior Ministry structure. Italy’s Postal Police opened an investigation into unauthorized computer access and computer fraud.
The Reggio Calabria public prosecutor subsequently opened a separate investigation under Article 615-ter of Italy’s criminal code, covering unauthorized access to a computer system of public interest.
But investigators have stressed an important uncertainty: they have not yet established whether a computer belonging to the prefecture or Interior Ministry was itself compromised.
That distinction is important because the attack appears to have exploited authentication rather than simply bypassing it.
Revolut said an unauthorized third party used an email address belonging to a legitimate government-agency domain to make fraudulent information requests. According to the company, those requests contained valid technical domain authentication and were therefore handled as mandatory legal requests with the expectation that they came from a genuine investigation.
Put differently, the email could technically appear legitimate while the person controlling it was not.
Hackers Allegedly Spent Months Requesting Customer Data
The attack was apparently not a single fraudulent email.
The group claiming responsibility, calling itself “iamnotavillain,” told the Financial Times that it first contacted Revolut while impersonating Italian police several months ago and subsequently made repeated requests for confidential customer information. The FT said it received redacted screenshots through Telegram that provided apparent supporting evidence of the email exchanges.
After Revolut's customer data leak, Italy is now asking how far this goes.
The files left Revolut after requests that arrived on a real Italian official channel. Revolut’s systems were not broken into. Revolut did not spot that the other end was not the agency it thought it was.… pic.twitter.com/aFMmki9Zln
— Max Karpis (@maxkarpis) September 16, 2026
Revolut eventually notified approximately 680 customers.
The potential exposure went well beyond names and email addresses.
Notifications reviewed by TechCrunch said compromised information could include dates of birth, postal and email addresses, telephone numbers, passports or driving licences, verification selfies, account statements and transaction histories.
In addition, IBANs, withdrawal records and Bitcoin transaction information were among the potentially exposed data.
Revolut maintains that its own systems were not breached and customer funds were unaffected. After identifying the fraudulent activity, it said it blocked the address and notified the relevant government agency, law enforcement, data-protection authorities and financial regulators.
Why Crypto Holders Appear to Have Been Targeted
The selection of victims may be the most revealing part of the operation.
The attackers told the Financial Times they specifically searched for customers with substantial cryptocurrency holdings, so-called crypto whales, using blockchain analysis. Most affected customers were reportedly in Switzerland and France, although victims were spread across another 31 predominantly European countries.
Former Mt. Gox CEO Mark Karpelès was among those affected, while it has also been identified German crypto entrepreneur Felix Römer as a victim.
This points to a potentially sophisticated reconnaissance model.
Public blockchains can reveal balances, transfers and relationships between addresses, but an address alone does not necessarily reveal the real-world identity or home address of its owner.
Government-style information requests could potentially provide the missing link.
If the attackers’ account is accurate, blockchain analysis helped identify valuable targets, while information obtained from Revolut connected financial activity to real-world identities.
That creates risks extending beyond conventional online fraud. A dataset combining crypto holdings, transaction histories, telephone numbers, identity documents and residential addresses could facilitate highly personalized phishing and impersonation attempts and, potentially, physical targeting.
$3 Million Monero Demand Followed
The operation has now apparently moved into extortion.
The group demanded 6,000 XMR, worth roughly $3 million, and threatened to sell the customer data to criminal groups if Revolut failed to pay, according to the Financial Times. The demand was published alongside a countdown timer.
Hackers want $3 million by tomorrow. Revolut says nobody has called. Italy has opened a file.
IAmNotAVillain put a clock on a site: 6,000 Monero (about $3m), pay in 24 hours, or the packs go on sale (FT). Reuters asked Revolut. The answer: no direct contact, no demand. The actor… pic.twitter.com/10NEStSqX4
— Max Karpis (@maxkarpis) September 17, 2026
The choice of Monero is significant. Unlike transparent blockchains such as Bitcoin, Monero is designed to conceal details about senders, recipients and transaction amounts, making XMR particularly attractive for users seeking transaction privacy.
There is, however, an important caveat.
Revolut told Reuters that it had received no direct communication or ransom demand from the alleged attackers. The publicly posted demand therefore should not be treated as evidence that Revolut entered ransom negotiations with the group.
The hackers have separately claimed to possess Italian police data, a claim that has prompted additional scrutiny from Italian authorities but has not been independently established.
Meanwhile, Britain’s Information Commissioner’s Office has confirmed that it received Revolut’s breach report and is assessing the incident.
The larger lesson from the attack is that a financial institution does not necessarily need to be technically breached for highly sensitive financial data to escape.
If the emerging evidence holds, the attackers instead chained together three trusted systems: public blockchain data identified potential targets, a government communications channel provided institutional legitimacy, and a bank’s compliance process delivered the information.
The hackers did not have to convince Revolut that they were hackers.
They had to convince Revolut that they were the police.
Share
Most read articles
