Hackers say they breached Italian state email to target Revolut ‘crypto whales’

Hackers who claim they were behind a data breach at Revolut say they obtained confidential customer information by compromising an Italian government email system and exchanging messages with the online bank over several months while posing as law enforcement.

The claims, made in a series of messages sent to the FT, suggest the hack affecting almost 700 Revolut customer accounts was more extensive than the data breach first acknowledged by the payments group on Friday.

In messages sent via Telegram, a hacker or hackers using the pseudonym iamnotavillain said they had first contacted Revolut a “couple of months ago, posing as a law enforcement entity” from Italy.

Over the following weeks the hackers said they had repeatedly asked Revolut to share confidential account details for specific customers, including addresses, phone numbers and transaction histories, claiming the information was needed for ongoing law enforcement activities.

“Revolut was complying like a ‘good boy’,” the purported hackers said.

The FT contacted the hackers via Telegram after they set up a website late on Monday displaying redacted screenshots of some of the information allegedly obtained from the bank.

The group then shared further screenshots with the FT, including images of some of the emails they claimed to have exchanged with Revolut while posing as Italian law enforcement.

Those messages appeared to show Revolut sharing customer account information with an arm of Italy’s interior ministry via the government’s La Posta Elettronica Certificata email system.

A person familiar with the matter confirmed that the requests Revolut received had come via Italy’s PEC system and the email exchanges had continued for several months.

PEC is a secure network overseen by a government agency that is used by Italian authorities, companies and private citizens to send official or legal correspondence — the digital equivalent of registered post.

Italy’s postal police, state police, interior ministry and cyber security agency declined to comment on the matter, although officials confirmed that investigations were under way.

The hacker’s requests for customer information do not appear to have been random. The group told the FT they selected the 680 targets by using blockchain analysis to identify Revolut accounts with significant crypto holdings.

“I rather not disclose my exact way of getting it, but it was via onchain analysis,” iamnotavillain said, describing the targets as “crypto whales”.

Most of the 680 customers came from Switzerland and France but Revolut also handed over data on residents in 31 other mainly European countries, including the UK, Germany and Spain, the hackers added.

The identity and motivation of the perpetrators remain unclear. Hackers often demand a ransom in exchange for the return or destruction of the stolen data.

A person familiar with the situation said Revolut had not been contacted by the perpetrators and was yet to receive a ransom demand.

Giulia Pastorella, a lawmaker from Italy’s opposition Azione party, has demanded immediate clarification from the interior ministry, calling the reported security breach of a ministry PEC email account “alarming at an unimaginable level” and pledging to raise the issue in parliament.

“We could be facing the tip of the iceberg,” Pastorella said in a social media post. “How many other emails have been sent from that governmental PEC? How many other companies have fallen victim to this scam?”

Revolut said its own systems and databases remained fully secure and had not been breached.

“This incident involved the fraudulent misuse of an official, state-regulated legal communication channel to impersonate legitimate authority requests,” it said.

Additional reporting by Giuliana Ricozzi in Rome