Attackers compromised an email account under the official @interno.it domain belonging to the Italian Ministry of Interior. By impersonating law enforcement, they submitted fraudulent emergency data requests to Revolut. The fintech company processed these requests between September 11 and September 12, disclosing personal information of approximately 680 to 700 users.
The exposed data includes identity documents, passports, verification selfies, IBANs, and Bitcoin transaction histories. The hackers, using the Telegram handle I Am Not A Villain, began leaking samples of this information and demanded a ransom of 10,000 Bitcoin from the affected individuals. Revolut stated that its internal systems were not breached and user funds remain secure.
Italian authorities, including the Polizia Postale and the National Cybersecurity Agency, are investigating how the government email account was compromised. Simultaneously, the UK Information Commissioner’s Office is reviewing whether Revolut followed proper verification procedures for data requests. Revolut has blocked the malicious email account and notified the relevant regulatory bodies.
