Revolut Data Leak May Trace Back to Compromised Italian Government Accounts
Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.
Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.
- Revolut systems not breached; attackers abused a legitimate pec.interno.it government mailbox to pose as police.
- ~680 customers' IDs, addresses, banking data, selfies and crypto transaction histories were obtained.
- Attackers used a 'spray and pray' strategy with hundreds of crypto transaction IDs and forged European Investigation Orders.
- IAmNotAVillain claims six-month access to Italian law-enforcement systems and 147 GB of stolen data, unverified.
- A second PEC address in copy may have boosted credibility; investigators need email headers and PEC logs.
- Tags
- cryptocurrencydata-breachgovernment-compromisei-am-not-a-villainitalypec-emailrevolutsocial-engineering
- Vendors
- Revolut
- Products
- PEC email
- Threat actors
- IAmNotAVillain
- Victims
- Revolut customers
- Countries
- Italy
From the original article
5 min read at securityaffairs.com
A suspected compromise of an Italian government PEC account may have allowed threat actors to impersonate law enforcement and obtain sensitive data from hundreds of Revolut customers. The Revolut data exposure may be part of a much broader cyber incident involving compromised Italian government infrastructure. Revolut has confirmed that its systems were not breached.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.