On September 12, 2026, Revolut publicly confirmed a significant data breach after receiving fraudulent requests from what appeared to be a legitimate government email domain. According to Financial Times, hackers claim to have breached an Italian government email system for 6-8 months before the intrusion was detected, specifically targeting Revolut's high-net-worth crypto customers. The attack compromised 680 confirmed customers with 147GB of data allegedly from broader Italian law enforcement systems, including passport scans, IBANs, bank statements, and Bitcoin transaction histories. Unlike the previous blockchain exploit that lost $320 million in a single transaction, this breach involved identity data leakage that creates permanent connections rather than recoverable financial losses.
The ransom demand was unveiled with a 24-hour countdown by the group calling itself "iamnotavillain" on September 16, demanding 6,000 Monero (XMR) worth approximately $3 million. According to Financial Times, the attackers threatened to sell sensitive customer records to criminals if Revolut did not pay, with several passports, driving licenses, identity photographs, and transaction histories visible in a video watched by the publication. The group identified customers with significant crypto holdings through blockchain analysis and acted as if they were law enforcement officials after compromising the Italian government email system. Revolut responded by stating they had not formally heard back from the group nor received any ransom demands, confirming that none of its internal nor client funds had been affected or breached.
According to Financial Times, the attack traces back to approximately 300 compromised pec.interno.it webmail logins harvested from infected machines through infostealer malware rather than a direct exploit of government servers. The compromised PEC systems exist because Italian law gives certified email the same legal standing as registered postal mail, making the domain valuable to attackers who can bypass normal company skepticism. Revolut maintains that its own core banking systems and customer funds were not breached, describing the incident as external impersonation where fraudulent data requests appeared to come from legitimate government domains. The breach echoes a recurring theme in fintech impersonation fraud, where companies build fast-lane processes for law enforcement requests, creating vulnerabilities that attackers exploit.
Italian prosecutors and the country's anti-mafia and counterterrorism authorities are now investigating the incident, according to an updated Euronews report. The UK Information Commissioner's Office opened a formal investigation on September 14, 2026, focusing on whether Revolut's verification process for law enforcement requests met UK GDPR standards rather than systems security. Cryptotimes reports that more customer dossiers are likely to surface on Telegram if the extortion demand remains unmet, keeping the story active into late September. The incident highlights a broader 2026 trend where attackers favor identity abuse over exploit development, buying stolen credentials from infostealer logs for a few dollars per machine on dark web markets. Revolut customers, particularly those with meaningful crypto holdings, should treat any unexpected contact referencing their account, balance, or identity documents with heightened suspicion.
