A hacker who goes by the alias IAmNotAVillain says the Revolut data breach that Financial Times, TechCrunch, and Reuters reported on September 12, 2026, was only the opening chapter. In new claims surfacing on September 15, the same actor says they spent six months inside multiple Italian law-enforcement systems, walked away with roughly 147GB of internal Italian police material, and used a hijacked government email account to trick Revolut into handing over records on nearly 700 high-value crypto customers. Revolut disputes the scale of the Italian systems claim. Italian authorities have said nothing at all.
The story matters beyond one fintech’s bad week. It exposes a soft spot that almost every regulated company shares: the near-total trust placed in official government email addresses, especially ones sitting on Italy’s legally binding PEC (Posta Elettronica Certificata) certified-mail system. If a fraudster can borrow that trust for a single afternoon, they can bypass identity checks that took years and millions of dollars to build.
What happened, according to named outlets
Revolut confirmed on September 12, 2026 that it had disclosed sensitive customer information to an unauthorized third party after receiving what it called fraudulent information requests sent from a legitimate government agency email domain, according to TechCrunch and Reuters. Cryptobriefing and follow-up reporting from the Financial Times, relayed by Yahoo Finance, put the number of affected clients at nearly 700, with most outlets settling on a range of 680 to 700 customers.
The compromised channel was traced to the @interno.it domain, tied to Italy’s Ministry of Interior (Viminale), with some reporting pointing specifically to a sender on the pec.interno.it PEC address, according to Cybersecurity News and Italian outlets covering the story. PEC is not an ordinary inbox. It is Italy’s certified email standard, treated as legally equivalent to registered postal mail and used by government bodies, courts, and law firms for binding official communication. That legal weight is exactly what made the fraudulent request believable enough for Revolut’s compliance team to act on it.
Security researchers examining the incident say the messages passed Revolut’s SPF, DKIM, and DMARC authentication checks because they genuinely originated from the government domain, not a lookalike. In other words, this wasn’t a spoofed sender header that a spam filter should have caught. Someone had operational access to a real, authenticated government mailbox.
The escalation: 147GB and a claimed six-month intrusion
The September 12 disclosure was framed by Revolut as a contained, one-off impersonation scam. That framing came under pressure three days later. On September 15, the threat actor IAmNotAVillain told researchers monitoring the case, including the account International Cyber Digest, that the Revolut operation was one output of a much longer campaign, according to reporting from IT-Connect and Cybersecurity News. The hacker claims to have held access to multiple departments of the Italian police for approximately six months and to be sitting on roughly 147GB of internal Italian law-enforcement material, including internal documents, calendars, and personal files.
The file counts attached to that claim have shifted as the story developed. An early screenshot circulated by the hacker showed 688 files across 204 folders, per Cybersecurity News. A later claim reported by IT-Connect put the figure far higher, at 36,393 files spread across 5,223 folders. Neither figure has been independently verified by Revolut, Italy’s Interior Ministry, Italy’s national cybersecurity agency (ACN), or Italian police. Italian commentary outlets, including Il Foglio, have described the alleged use of the PEC system as a “Trojan horse,” warning that any single compromised certified-mail account creates outsized downstream risk precisely because so many private companies treat PEC messages as automatically authoritative.
It is worth separating two different claims that have gotten blended together in social coverage of this story. The first: a real government email address was used to extract real customer data from Revolut. That part is confirmed by Revolut itself. The second: the same actor separately breached deep into Italian law-enforcement infrastructure for half a year. That part remains an unverified assertion from the attacker, repeated by researchers monitoring the leak but not confirmed by any government body.
Who was targeted, and what data got out
The victims were not random Revolut users. Reporting from multiple outlets describes the targets as high-net-worth customers, many involved in crypto asset businesses, colloquially termed “crypto whales.” A crypto investigator known as ZachXBT, cited by Cybersecurity News, assessed that the operation was deliberately aimed at high-net-worth users rather than a broad customer sweep.
The exposed data package, according to reporting aggregated by CryptoTimes and IT-Connect, included names, dates of birth, occupations, postal and email addresses, phone numbers, copies of passports and driver’s licenses, the identity-verification selfies Revolut requires during KYC onboarding, bank statements, full transaction histories, IBANs, and Bitcoin transaction records. International Cyber Digest posts cited by IT-Connect indicate most affected customers are based in Switzerland and France, with additional records tied to residents of roughly 30 countries in total, including Cyprus, Portugal, Germany, Spain, Bulgaria, Czechia, Romania, Poland, Malta, Norway, and Sweden.
Some reporting has named individuals allegedly among the affected customers, including a tennis player and a professional footballer, along with a crypto casino executive, though tech-insider.org is not independently confirming those individual identifications and treats them as unverified claims sourced to social-media leak monitoring rather than Revolut disclosures.
The extortion demand
The attacker is not simply sitting on the data. According to CryptoTimes and IT-Connect, IAmNotAVillain has demanded 10,000 bitcoin, worth roughly €673 million at current exchange rates, threatening to keep publishing customer records on Telegram for as long as Revolut refuses to pay. Identity documents and verification selfies tied to the KYC process have already been posted publicly as proof of the breach, a pressure tactic common in modern extortion-style data leaks where the goal is reputational damage rather than direct account takeover.
There is no reporting from any named outlet confirming that Revolut has paid, or intends to pay, any part of that demand. The 10,000 BTC figure should be read strictly as an attacker’s asking price, not a negotiated or accepted sum.
Revolut’s response
Revolut has consistently characterized the incident as what the company describes as a sophisticated external impersonation scam, emphasizing that its own technical infrastructure and customer funds were not affected, according to statements relayed by Reuters and Italian outlets covering the disclosure. A company spokesperson told Reuters that upon detection, Revolut immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection authorities, and financial regulators. The company has said it contacted affected customers directly.
CryptoTimes reported on September 15 that UK regulators have opened scrutiny into the incident, consistent with Revolut’s UK banking license and its obligations under British data protection rules, though the exact scope and formal status of that review has not been detailed in available reporting.
What Revolut has not done, based on available reporting, is confirm the attacker’s broader claim about a six-month Italian law-enforcement compromise. That silence is doing a lot of work in this story. Revolut has every incentive to frame the incident narrowly, as a single fraudulent-request event it could not have prevented through its own security controls, rather than as evidence of a state-adjacent security failure it has no way to independently verify or refute.
Why trusted-channel attacks are so hard to stop
Most large-scale breaches covered on this site involve a technical exploit: an unpatched server, a leaked credential, a vulnerable API. This incident is different, and in some ways more unsettling, because Revolut’s technology reportedly worked exactly as designed. The emails came from a real domain. They passed real authentication checks. A human reviewer, following a legitimate legal-request process that regulated fintechs are required to maintain, approved what looked like a lawful law-enforcement data request.
That is the structural problem with law-enforcement request abuse: it exploits a process companies are legally obligated to maintain and respond to promptly. Slow down every government data request for manual, multi-day verification, and a company risks obstructing real investigations and drawing regulatory penalties. Fast-track them, and a single compromised or borrowed government mailbox becomes a skeleton key. Fintechs, cloud providers, and telecoms handling large volumes of law-enforcement requests face this tension constantly, and this incident shows what happens when the trust gets exploited at scale.
Historical context: this keeps happening
Fake law-enforcement data requests, sometimes called Emergency Data Request (EDR) fraud in US contexts, are not new. US tech companies including Apple, Meta, and Discord have previously disclosed handing over user data to hackers who compromised or impersonated police and government email accounts, exploiting the same urgency-driven trust that legitimate emergency legal process depends on. What sets the Revolut case apart is the apparent use of Italy’s PEC certified-mail infrastructure specifically, a system designed to carry more legal weight than a typical government email address, which may explain why Revolut’s compliance process treated the request as more authoritative than a standard inbound email.
tech-insider.org covered Revolut’s initial September 12 disclosure as the story broke. This report focuses on what has changed since: the escalated 147GB Italian law-enforcement claim, the 10,000 BTC extortion demand, and the widening list of affected countries that emerged in the three days that followed.
Market and industry impact
Revolut has been preparing for a stock market listing and has courted a premium valuation built partly on its reputation as a modern, security-conscious challenger bank serving over 65 million customers globally, according to the company’s own public statements. A breach narrative involving KYC documents, passport scans, and cryptocurrency transaction histories for its wealthiest crypto-holding customers is precisely the kind of story that unsettles institutional investors evaluating fintech IPO candidates, even when the root cause sits outside the company’s own infrastructure.
For the wider fintech and crypto-custody sector, the incident is likely to accelerate scrutiny of how exchanges, neobanks, and custodians verify inbound law-enforcement requests. Expect compliance teams at comparable firms, including Revolut’s direct neobank competitors, to quietly review or tighten their own legal-request intake procedures in the coming weeks, even without a public announcement.
How this compares to other 2026 government-trust breaches
The Revolut case sits alongside a string of 2026 incidents in which attackers weaponized trust in official or verified channels rather than breaking through a firewall. The table below places it against other notable data-exposure events this year, based strictly on figures reported by the outlets covering each incident.
| Incident | Vector | Records / customers affected | Reported ransom / demand |
|---|---|---|---|
| Revolut / Italian government email (Sept 2026) | Impersonated government law-enforcement email request | ~680-700 customers (crypto whales) | 10,000 BTC (~€673M), per CryptoTimes |
| IDScan.net breach | Compromised ID verification vendor | ~150-153 million IDs, per prior tech-insider.org reporting | Not publicly disclosed |
| Trezor / Brevo phishing breach | Third-party mailing vendor compromise | ~347,000 crypto owners, per prior tech-insider.org reporting | Not publicly disclosed |
| Florida DMV breach | Compromised officer personal device | ~200,000 IDs, per prior tech-insider.org reporting | Extortion deadline reported, no confirmed payment |
The common thread is not a software vulnerability. It is misplaced trust in a verification layer, whether that layer is a government email domain, a KYC vendor’s credential store, or a mailing-list provider’s admin panel. Attackers in 2026 have increasingly learned that the fastest way to a bank’s customer data is not to break its systems, but to convince its compliance team that a request is legitimate.
Timeline of the Revolut breach
| Date | Event |
|---|---|
| Sept 11-12, 2026 | Fraudulent data requests sent and processed via the compromised Italian government email domain, per Cryptobriefing and Kelacyber |
| Sept 12, 2026 | Revolut publicly confirms the disclosure, calling it an external impersonation scam; Reuters, Bloomberg, and TechCrunch report the story |
| Sept 13-14, 2026 | Financial Times reporting, relayed by Yahoo Finance, puts affected customers at nearly 700; extortion and Telegram leak activity begins |
| Sept 15, 2026 | Hacker IAmNotAVillain claims six months of access to Italian law-enforcement systems and 147GB of stolen material; Financial Times publishes “Hackers say they breached Italian state email to target Revolut ‘crypto whales’”; CryptoTimes reports UK regulatory scrutiny and the 10,000 BTC demand |
What Italian authorities have and haven’t confirmed
As of this report, neither Italy’s Ministry of Interior, its national cybersecurity agency ACN, nor Italian police have publicly confirmed or denied that their internal systems, beyond the single abused email address, were compromised. That silence leaves the 147GB and six-month access claims resting entirely on the attacker’s own statements and analysis from independent researchers monitoring leaked file samples, not on any government acknowledgment. Readers should treat the broader Italian law-enforcement compromise claim as unverified until an official body confirms or refutes it.
What happens next: predictions
- Expect Revolut to face formal regulatory inquiries in multiple jurisdictions beyond the UK, given that affected customers span roughly 30 countries according to leak-monitoring reports, likely triggering GDPR notification obligations across the EU.
- Watch for Italy’s Interior Ministry or ACN to eventually issue a formal statement, even a narrow one, given the volume of international press attention; continued silence will itself become a story.
- Other fintechs and exchanges handling law-enforcement data requests will likely tighten manual verification steps for urgent government requests in the coming weeks, even without public announcements.
- The 10,000 BTC extortion demand is unlikely to be paid outright; expect continued incremental data leaks on Telegram as pressure tactics rather than a lump-sum resolution.
- If the 147GB Italian law-enforcement claim is eventually substantiated, expect scrutiny to shift toward Italy’s PEC certified-mail infrastructure and whether other agencies relying on it face similar exposure.
What Revolut customers should do now
Revolut has said it is contacting affected customers directly, but given how identity documents were exposed, anyone concerned should independently watch for signs of identity misuse. That includes monitoring for new accounts opened using leaked passport or driver’s license data, enabling additional authentication on any linked crypto exchange accounts, and treating any inbound communication claiming to be from Revolut, a government agency, or law enforcement referencing this breach with extra skepticism, since the same social-engineering pattern that fooled Revolut’s own compliance team could be reused against individual customers in follow-up phishing attempts.
What this means for the crypto custody industry
Crypto-holding customers of any regulated fintech occupy an unusual risk position. They are subject to the same KYC and AML disclosure requirements as any bank customer, meaning their identity documents and transaction histories sit inside conventional financial-services infrastructure, while the assets those records point to are, unlike a traditional bank balance, often irreversible once moved. That combination makes “crypto whale” customer files an unusually attractive target: the data unlocks identity fraud opportunities typical of any breach, plus a direct map of who holds enough digital assets to make a targeted extortion, SIM-swap, or physical security threat worthwhile.
Frequently asked questions
What is the Revolut Italian government email breach?
Hackers used a legitimate Italian government email address, reportedly on the interno.it domain tied to Italy’s Ministry of Interior, to send fraudulent law-enforcement-style data requests to Revolut. Revolut confirmed on September 12, 2026 that it disclosed sensitive customer data to an unauthorized third party as a result.
How many Revolut customers were affected?
Reporting from the Financial Times, relayed by Yahoo Finance, and corroborated by Cryptobriefing and CryptoTimes, puts the number at roughly 680 to nearly 700 customers, described as high-net-worth “crypto whale” clients.
Who is IAmNotAVillain?
IAmNotAVillain is the online alias used by the threat actor claiming responsibility for the Revolut data theft. The same actor claims separately to have accessed multiple Italian law-enforcement departments for roughly six months and to hold about 147GB of internal Italian police data, a claim that remains unverified by any government body.
Did hackers actually breach Italian law enforcement systems?
That is not confirmed. It is an unverified claim made by the attacker and repeated by researchers monitoring leaked file samples. Italy’s Interior Ministry, its cybersecurity agency ACN, and Italian police have not publicly confirmed or denied the claim as of this report.
What data was exposed in the Revolut breach?
According to CryptoTimes and IT-Connect, exposed data included names, dates of birth, occupations, addresses, phone numbers, passport and driver’s license copies, KYC verification selfies, bank statements, full transaction histories, IBANs, and Bitcoin transaction records.
How much ransom are the hackers demanding?
CryptoTimes and IT-Connect report a demand of 10,000 bitcoin, worth roughly €673 million at current exchange rates. There is no confirmed reporting that Revolut has paid any part of this demand.
Was Revolut’s own security infrastructure hacked?
Revolut says no. The company describes the incident as an external impersonation scam and states that its technical systems and customer funds were not compromised, characterizing the breach as fraudulent misuse of a legitimate government email channel rather than a direct intrusion into Revolut’s own servers.
What should affected Revolut customers do?
Revolut says it is contacting affected customers directly. Customers with exposed identity documents should watch for signs of identity misuse, add extra authentication on linked crypto accounts, and treat unexpected messages referencing this breach, even ones appearing to come from government or law-enforcement senders, with heightened skepticism.
