Attackers allegedly stole Revolut customer data by sending fraudulent “government” legal requests for roughly five months. The requests appeared legitimate because they came from a compromised government employee email account, leading Revolut to comply and disclose sensitive personal and financial data. The attacker later demanded $3M and threatened to sell the data publicly.
According to reporting, attackers compromised a government employee's email account, tied to the pec.interno.it domain associated with the Italian Ministry of the Interior, using an infostealer infection. From that account, they sent fraudulent legal requests to Revolut Bank UAB posing as an official government agency. Because Revolut is required to respond to legitimate law enforcement requests, the requests were treated as valid and the company complied, disclosing sensitive personal and financial data on roughly 680 customers, described as cryptocurrency whales. This campaign reportedly continued for about five months before it became public.
The core reason this worked is that the requests came from a real, compromised government email account rather than a spoofed or lookalike domain. That authenticity removed the usual visual red flags defenders are trained to spot. Compliance and legal teams, operating under a legal obligation to respond to law enforcement, prioritized speed and procedural compliance over independent verification of the requesting party. Hudson Rock's assessment that the attacker likely used purchased infostealer logs rather than directly targeting the government employee also shows how credential theft far outside an organization's own environment can still be weaponized against it.
Organizations that regularly field legal and government data requests should treat that workflow as high-risk by default. Key steps include:
This case shows that authority-based trust in email, even from a legitimate domain, is not a substitute for verifying the actual requester through a separate, trusted channel.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They compromised a government employee's email account and used it to send fraudulent legal requests to Revolut, which complied because it is required to respond to law enforcement requests.
Roughly 680 customers, described as cryptocurrency whales, reportedly had personal and financial information exposed.
A threat actor calling themselves IAmNotAVillain publicly demanded $3 million and threatened to sell the data, though Revolut said it had not received a direct ransom demand.
Verify legal or government data requests through independent, known channels before releasing customer data, since even legitimate-looking government email accounts can be compromised.
Revolut handed over crypto‑whale data for months… to fake government orders sent from a real gov email. Attackers hacked a government employee, then used their pec.interno.it inbox to send “official” legal demands. Revolut, required to answer law‑enforcement, sent back detailed customer records, about 680 high‑value crypto clients. The giveaway? Everything relied on email authority: urgent tone, government logo, real domain, but no check through Revolut’s own legal request portal or known contacts. Later, someone calling themselves “IAmNotAVillain” bragged and demanded $3 million. Here’s the move: if you ever get a legal or government request for customer data, stop. Don’t reply to the email. Call or use our approved legal-request channel to verify it first.
Attackers used a compromised government email account to pose as authorities and request customer records from Revolut. Employees believed the requests were legitimate and voluntarily sent sensitive customer information, exposing data for nearly 700 people. The incident highlights how “trusted”…
Revolut confirmed it disclosed sensitive customer information after fraudsters sent “emergency” information requests from a legitimate government email domain. The attackers appear to have targeted high-net-worth customers, including people involved in crypto, and attempted to extort Revolut to…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Revolut confirmed a breach after an attacker impersonated a government agency and sent fraudulent data requests from what appeared to be a legitimate government email domain. Employees processed the requests as normal legal-compliance work, leading to exposure of sensitive customer identity and…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
