How a fake survey got Revolut to hand over the data of 680 customers.

(Image caption) The exterior of Revolut's global headquarters building in Canary Wharf, London. The modern glass curtain wall architecture reflects the scale and international positioning of this leading European fintech company. The customer data breach discussed in the article did not originate from a breach of the company's core systems, but rather leaked through an existing government data request process.

Information on 680 customers was leaked through bank procedures.

In September 2026, European fintech company Revolut admitted that some of its customers' personal data had been given to unauthorized third parties. The Italian government later disclosed that a total of 680 customers were affected. Attackers used compromised Italian government email accounts to impersonate law enforcement officials and make data requests. Revolut stated that its own systems were not compromised and customer funds were not affected, but some customer information did indeed flow through the bank's government data request processing procedures to individuals impersonating investigators.

The most noteworthy aspect of this incident, according to Revolut, is that the bank did not lose data despite the breach of its core systems. The attackers exploited the communication credentials of a government agency and the bank's existing legally mandated cooperation with the investigation, ultimately allowing a rigorously verified disclosure to serve those without legal authorization.

On September 18, Italian Deputy Minister of the Interior Wanda Ferro stated during a parliamentary inquiry that the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) received a notification from Revolut on September 12 regarding a potential cybersecurity incident. Their technical team, through analysis of email samples, confirmed that a certified email account belonging to the Prefectural Government of Reggio Calabria had been compromised. The Prefectural Government is a local government agency of the Italian Ministry of the Interior. She also disclosed that Revolut further confirmed the data breach to the ACN on September 15, involving 680 clients, including 8 Italian clients.

On October 7, Béatrice Cossa-Dumurgier, CEO of Revolut Western Europe, further stated in an interview with French BFM television that 55 of the affected customers were located in France. The company has provided assistance to the affected customers, and Revolut will cover any costs associated with changing their identification documents if necessary. She stated that the company will not pay a ransom and reiterated that Revolut's own systems have not been compromised.

Information disclosed by the Italian government and Revolut management has established the basic scope of the incident. The 680 customers are located in different countries, including at least those in Italy and France; however, as of October 10, no incident report published by regulatory authorities has been available, providing a complete list of all affected countries and data categories.

For financial institutions, 680 people is not a large number. Revolut has tens of millions of customers in Europe, and the number involved in this incident represents only a small fraction of its customer base. However, the issues revealed by the way the data was obtained could impact all banks that need to handle cross-border legal claims.

Banks have a legal obligation to assist legitimate investigations and a responsibility to protect their customers' personal and financial information. Both obligations need to be safeguarded within the same set of procedures. When an email with a governmental appearance is sufficient to trigger information disclosure, the most crucial aspect to re-examine is how the bank verifies the source, legal validity, and recipient's identity of the request.

(Image caption) A Revolut card photographed in January 2018. In this incident, customer information was transferred to impersonators of law enforcement officers through the bank's process of handling government requests; Revolut stated that its system was not compromised and customer funds were unaffected.

Why do government email accounts gain the trust of banks?

Italy uses a certified email system called Posta Elettronica Certificata (PEC). This system is widely used in formal communications between governments, businesses, and professional organizations, providing legally valid proof of delivery for electronic documents through certified sending and receiving records.

The PEC (Public Administration and Communications Authority) plays a vital role in Italian administrative and commercial life. Government departments use it to transmit official notices, and businesses use it to handle legally binding documents. For multinational banks, requests for information from legitimate government domains and delivered through official communication channels naturally attract more attention from legal and compliance departments than ordinary private emails. While this system helps verify the transmission of emails, it cannot solely prove that the account holder has legitimate investigative powers.

The Revolut incident involves a verified email address belonging to the Prefectural Government of Reggio Calabria, Italy. On September 17, the Italian Senate published written inquiry number 4-03368, in which senators cited media reports and circulating email screenshots, demanding that the government explain how attackers used the relevant email address to impersonate judicial investigators, and why Revolut accepted these requests.

The inquiry points out that the imposters reportedly cited investigations by the Milan prosecutor's office and European rules on cross-border judicial cooperation to request customer information from banks. The documents also mention that some email exchanges may have lasted for months, and the attackers claimed to have obtained a large amount of confidential information.

However, the congressional interrogation records only contain the questions raised by members of Congress and the materials they cited, and cannot be directly considered as evidence that the government has verified all the content. In particular, the duration of the email exchanges, the 147GB of data claimed by the attackers, and the reasons for the selection of individual clients still require support from the original communication records, technical forensics, and formal conclusions from investigative authorities.

The technical analysis by the Italian National Cyber Security Agency (CSIRT) provided more concrete evidence. In response to Wanda Ferro's inquiry, CSIRT Italia analyzed a sample email provided by Revolut, confirming that the relevant government accounts had indeed been compromised. This distinguishes the incident from typical email scams involving spoofed mail addresses: the attackers utilized communication resources linked to legitimate government agencies.

On September 30, Italian Interior Minister Matteo Piantedosi stated in Parliament that the PEC email address in question, named "entilocali," belonged to the Prefectural Governor's Office of Reggio Calabria and had not been used before. He criticized the bank for potentially discovering inconsistencies between the requested information and the issuing authority, as well as questionable quantities and types of requested information, through basic due diligence. A Revolut spokesperson declined to comment on the minister's remarks, while its Western European CEO stated that government agencies can sometimes become weak links in the overall security system.

The statements from both sides involve two separate responsibilities that require investigation. The government has an obligation to protect its communication accounts and authentication systems, while the bank needs to verify whether a request comes from an authority that is truly authorized to make such a request.

Currently, there is insufficient publicly available evidence to determine how the attackers initially gained control of the accounts, when the government detected the anomalies, and what verification procedures the bank performed before each data delivery. The final allocation of responsibility awaits a more complete investigation.

(Image caption) Exterior view of the Prefectural Government Office of Reggio Calabria, Italy. The Italian government has confirmed that the authenticated email account used by the attackers belonged to this government office. This file photo shows the location of the agency in question, not the scene of the incident investigation.

What authorization is required for an investigation order?

The attackers reportedly exploited the authoritative appearance of the European criminal justice cooperation system.

The EU Directive 2014/41/EU established the European Investigation Order (EIO) system, which allows the competent judicial authorities of member states to request specific investigative measures from another member state during criminal investigations. This system aims to improve the efficiency of cross-border investigations while preserving the principles of judicial review, necessity, and proportionality, as well as the protection of the rights of the parties involved.

According to the directive, European investigative orders must be issued by a competent judicial authority or, as required, confirmed by a judicial authority. The document must specify the issuing authority, the purpose of the investigation, the background of the case, the measures required, and the types of evidence. The implementing country's competent authority then handles the request in accordance with its national laws and the EU system.

Therefore, a government email with an official document attached, even if transmitted through a legitimate government email system, does not automatically acquire the legal effect of cross-border judicial evidence collection. The source of the email, the authority to issue it, judicial confirmation, the enforcement procedure, and the scope of document delivery all have their own legal requirements.

This distinction is particularly important in the Revolut case. The alleged impersonation request raised during the Italian parliamentary inquiry reportedly used the name of a European investigation order, but the relevant documents have not yet been fully disclosed in public information. Therefore, it is impossible to confirm exactly which legal format the attackers forged, whether they used genuine case numbers, whether they impersonated judicial signatures, and under what specific legal procedures Revolut decided to deliver the documents.

For a cross-border bank, handling legitimate investigation requests typically involves multiple stages. Legal personnel need to determine whether the requesting authority has the authority, compliance personnel need to verify whether the type of information is appropriate for the scope of the investigation, and information security and data management personnel are responsible for ensuring that the documents are delivered through appropriate channels.

If banks only verify the sender's address and the appearance of the documents, but fail to confirm the identity of the sending authority through independent channels, a genuine government email address could become the most convincing tool for impersonators. This also exposes a system originally designed to safeguard cross-border judicial cooperation to new technological risks.

European investigations rely on mutual trust between member state judicial authorities, but this trust must be built on verifiable legal identities and procedures. When communication channels are controlled, financial institutions must still be able to distinguish between the holder of a government account, the actual sender, and the judicial authority with legal power. Whether Revolut possesses this capability, and at what point the relevant procedures failed, remains to be investigated.

After data leaks, who bears the risk?

Revolut emphasized that the bank's systems were not compromised and customer funds were unaffected. This statement is crucial in determining the nature of the incident, as there is currently no publicly available evidence that attackers directly controlled customer accounts or completed unauthorized fund transfers.

However, the value of financial information is not limited to account balances. During account opening and ongoing compliance processes, banks typically need to retain customers' names, addresses, identification documents, account information, and some transaction records. This information is originally used to verify customer identity, prevent money laundering, process transactions, and respond to legitimate investigations. If obtained by unauthorized individuals, it could be used for identity theft, targeted fraud, or other criminal activities.

In this case, it is particularly important to distinguish between the confirmed breach and the scope of unverified information. Revolut has acknowledged the improper disclosure of some customers' personal data. The information in media reports concerning addresses, identification documents, and certain financial activity records requires further investigation, in conjunction with more complete incident reports or regulatory documents, to confirm the actual coverage of each type of data and the impact on different customers.

For affected customers, data breaches can have long-term consequences. Banks can disable account login credentials, update security measures, and assist customers in changing their identification documents; however, addresses, transaction records, and copied documents may not all be recoverable through a single technical operation.

Revolut promises to cover the necessary costs of replacing identity documents, which is a specific remedial measure after the incident. It can alleviate some of the direct expenses for customers, but this does not presume that the leaked data has been deleted or that all subsequent risks have been eliminated.

For banks, incident handling may conclude with system checks, customer notifications, and regulatory reports; for individuals, the uncertainty arising from the copying of their data can last much longer. This time lag is a key difference between financial data protection and general system failure handling.

(Image caption) On October 22, 2022, Matteo Piantedosi attended his swearing-in ceremony at the Quirinal Palace in Rome. The Italian Interior Minister later criticized the bank for failing to adequately verify information requests following the Revolut scandal; the image is a file photo taken during his inauguration.

From which day does the 72-hour reporting rule begin?

The Revolut incident raises another legal question that needs to be clarified: Did the bank fulfill its reporting obligations under the EU's General Data Protection Regulation (GDPR) after discovering that personal data had been obtained by an unauthorized person?

Article 33 of the GDPR stipulates that a data controller, upon becoming aware of a breach of personal data, must notify the competent regulatory authority within 72 hours, without undue delay, and where feasible, unless the incident is unlikely to pose a risk to the rights and freedoms of a natural person. If the notice exceeds 72 hours, the reason for the delay must be provided. Even if the incident falls under the exception of not requiring notification, the controller must still record the incident as required.

Article 34 has another requirement: if the disclosure of information may pose a high risk to an individual's rights and freedoms, the data controller must, in principle, notify the affected person without undue delay, unless the exceptions set forth in the article apply.

These two regulations address different responsibilities. Article 33 concerns reporting to regulatory authorities, while Article 34 concerns reporting to individuals. The legal thresholds for these two provisions differ, and the 72-hour period should not be interpreted as requiring all customers to receive notification within 72 hours of an incident.

The most crucial timeline regarding the Revolut incident has not yet been fully disclosed. The Italian government revealed that ACN received a notification from Revolut on September 12 regarding a potential cybersecurity incident; on September 15, Revolut further confirmed the data breach to ACN and specified the number of affected customers. These are two separate notifications, and the latter date cannot be directly taken as the point at which the company first became aware of the incident.

The 72-hour period stipulated by GDPR, in principle, begins when the data controller becomes aware of the data breach, and does not necessarily start from the date the attacker first logs into the government email account, the first fake survey request is delivered, or the date the data is first delivered. The guidelines of the European Data Protection Committee interpret "awareness" as: the organization has a reasonable degree of confidence that a security incident has occurred and that personal data is at risk.

Therefore, determining whether the notification was timely requires comparing the time it took for the bank to obtain this assurance with the time it took to notify the competent data protection authority. The ACN is a cybersecurity authority, and records of notifications to it alone cannot prove that Revolut has fulfilled the notification requirement of Article 33 of the GDPR; the three-day interval between September 12th and 15th cannot be directly used to determine whether the company is compliant or in violation.

Currently, Revolut has not submitted the original incident notification to the competent data protection authority, nor has a complete internal incident timeline been available. Therefore, it cannot be concluded that the company has complied with or violated the GDPR's 72-hour requirement based solely on these two published dates.

Revolut's banking operations in Europe involve jurisdictions such as Lithuania, requiring clarification on which legal entity controls the data in question, which cross-border regulatory arrangements apply, and which data protection authority has primary jurisdiction. For UK clients involving independent UK data controllers, the UK GDPR and local regulatory requirements may also apply, making it impossible to simplify all clients' legal relationships into a single EU regulatory process.

Whether the notification of this incident was timely ultimately needs to be judged based on the legal status of the data controller, the time when the incident became known, the actual notification records, and the risk assessment documents.

What answers do the government and banks each need to provide?

The public disagreement between the Italian government and Revolut involves a fundamental responsibility in the financial data protection system: when a government agency’s communications channels are exploited by criminals, should banks still bear the independent obligation to verify the legitimacy of the data delivery?

On September 30, Italian Interior Minister Matteo Piantedosi criticized Revolut for failing to adequately verify the requested information, arguing that basic due diligence might have uncovered the problem. A Revolut spokesperson declined to comment on the minister's remarks, but its management pointed out that government agencies could also be a weak link in the system. A Reuters report on October 7 documented these differing public positions.

The government's criticism has a legal and procedural background. Banks cannot simply hand over customer information just because someone claims to be a law enforcement officer; there must be appropriate legal grounds for the requests, and the requested information must comply with relevant judicial procedures and applicable data protection regulations.

However, government agencies also bear security responsibilities. When an officially authenticated email system is used by public institutions for formal communications, recipients naturally place a certain degree of trust in it. If the government fails to detect account irregularities in a timely manner, or lacks effective access control and monitoring of unusual activity, criminals may exploit this trust to commit cross-agency fraud.

This means that liability for an incident may simultaneously involve government communications security, bank legal verification, data delivery procedures, and the attacker's own criminal acts. There is no inherent mutually exclusive relationship between these different liabilities.

In accordance with the principles of Articles 5 and 32 of the GDPR, organizations processing personal data must ensure adequate security and implement technical and organizational measures proportionate to the risks of their processing activities. Article 5 also requires that data processing be lawful, fair, and transparent, and adhere to the principle of data minimization. Even if the purpose of data delivery appears to be to cooperate with a criminal investigation, banks must still confirm that the disclosure has an appropriate legal basis and that the scope of the data does not exceed what is necessary.

However, whether the GDPR has been violated, which revolut entity should bear the relevant responsibility, and whether administrative penalties are necessary are all issues that the competent regulatory authority must determine based on the specific facts. The existing information is insufficient to support a conclusion of violation for any party.

For an investigation, what is truly needed is a complete record of the decision-making process: when government accounts were taken into custody, when the request for a fake investigation was made, when the bank verified the documents, which department approved the delivery of the data, when the data left the bank, and who ultimately discovered the incident.

Only if this timeline can be established can it be determined which stage the security vulnerability was concentrated in, and which protective measures could have prevented the incident from happening.

(Image caption) Scene inside the Italian Chamber of Deputies, showing the operation of the parliamentary questioning and oversight mechanisms. Wanda Ferro, Parliamentary Undersecretary of the Interior, answered questions here regarding the Revolut incident and the 680 affected customers, confirming that the National Cyber Security Agency had analyzed the email samples involved.

How do banks verify government identities?

Financial institutions handle a large number of external requests daily, ranging from court orders, regulatory inquiries, anti-money laundering investigations, tax information requests, and criminal justice cooperation. These procedures typically have deadlines, and some are subject to confidentiality obligations; banks cannot simply eliminate risk by refusing to provide information.

The Revolut case raises the question of whether banks can establish an identity verification process that does not rely on a single email address or document appearance while maintaining the efficiency of legitimate investigations.

First, it is necessary to distinguish between communication identity and legal authority. Authentication of email records can help confirm communication channels and delivery status, but whether the person making the request has investigative authority, whether the relevant documents were legally issued, and whether the receiving agency has the appropriate qualifications still need to be confirmed through judicial procedures.

Article 7 of the EU's European Directive on Investigative Orders provides an important institutional arrangement for issues concerning the authenticity and transmission of documents: difficulties involving the transmission or authenticity of investigative orders can be resolved through direct contact between the issuing and enforcing authorities, and, if necessary, through assistance from the central authorities of member states. This provision provides a formal channel for cross-border judicial verification. It does not equate to requiring banks to directly contact foreign judges in all cases, but it demonstrates that cross-border judicial cooperation already has legal procedures for handling the authenticity of documents.

Banks can establish established procedures for verifying investigative requests with competent authorities, provided they comply with local laws. When requests involve large amounts of identification documents, transaction records, or other highly sensitive information, the level of verification should be commensurate with the potential harm. Contact information for independent verification agencies, confirmation of legal document numbers, review of legal basis, and the scope of delivery are all control measures worth examining.

Data delivery also needs to leave a traceable record. Which fields were retrieved, who approved the retrieval, through what channels the files were delivered, how the recipient completed the identity verification, and how the voucher was preserved after delivery will all affect whether the facts can be reconstructed after an incident.

In multinational financial groups, this work also involves organizational structure. A bank may hold a license in one country, establish customer service or compliance teams in another, and handle data requests from multiple governments through centralized systems. The legal entity, data controller, actual approvers, and technical operators may not be located in the same jurisdiction.

Centralized processing can improve efficiency, but if a central team treats official email addresses as sufficient proof of identity, errors could spread across multiple countries.

Whether the Revolut incident involved a centralized process issue is currently unclear due to insufficient publicly available information. For other cross-border banks, this incident provides a specific area for investigation: are the verification standards required by government data as stringent as the security standards banks use for customer logins, fund transfers, and high-risk transactions?

Banks typically do not allow strangers to control customer funds based solely on an email. When a request involves information that could be used for impersonation, fraud, or tracking of personal financial activities, there should also be a proportionate independent verification process.

Boundaries of Responsibility for Cross-border Financial Information

The Revolut incident occurred in Europe, but it shares institutional characteristics with the global financial industry.

Cross-border banks need to navigate the legal systems of different countries to manage data requirements. Governments expect financial institutions to promptly assist in investigations of money laundering, fraud, tax evasion, and other crimes; banks, in turn, must simultaneously fulfill their obligations to ensure financial confidentiality, protect personal data, and safeguard customer rights.

Within the EU, the European Investigation Order, the GDPR, and national criminal procedure laws constitute different layers of legal arrangements. The former handles specific cross-border criminal evidence-gathering procedures, while the latter regulates the processing and protection of personal data. When banks actually deliver data, they may also need to comply with local laws, financial regulatory requirements, and relevant judicial decisions. These systems each have their own purpose, but they must work together in specific cases.

Similar issues exist in the United States, the United Kingdom, and other financial centers, but the legal basis for judicial authorization, data protection, and financial institutions' disclosure obligations differs. Banks cannot simply apply the government data requirements procedures of one jurisdiction as universally applicable legal standards.

The financial industry has historically invested heavily in protecting account access, payment authorization, transaction monitoring, and core system security. With cross-border data requests becoming increasingly electronic, another security aspect requires equal attention: verifying whether the requesting public institution, and the individuals actually using that institution's identity, have the legitimate right to obtain the data.

This work is closely related to traditional cybersecurity, but it goes beyond the scope of typical firewalls, malware detection, or account password management. It requires the collaborative efforts of legal, compliance, information security, and government agencies. Banks must trust legal processes and have the ability to verify them.

For governments, certified email and e-judicial cooperation mechanisms cannot solely focus on document delivery speed. Public institutions need to ensure that account permissions, user identities, abnormal operations, and document issuance records can be reliably managed and traced. Otherwise, the credibility that government communication systems are meant to build could be exploited by attackers to defraud financial institutions.

(Image caption) Portrait of Béatrice Cossa-Dumurgier, CEO of Revolut Western Europe. In an interview with French media, she confirmed that 55 of the affected customers were located in France, that the company had provided assistance and stated that it would not pay a ransom, while reiterating that its systems had not been compromised.

After 680 customers, what questions remain unanswered?

As of October 10, 2026, several key facts regarding the Revolut incident remain undocumented.

The exact time when the attackers gained control of the government email account still requires official verification from Italian investigative authorities. A complete public list has not yet been released regarding how many fraudulent investigation requests Revolut received, how many times the data was delivered, how many clients were involved in each instance, or which data fields were actually leaked.

How the bank handled these requests internally also needs further investigation. Whether there were legal reviews, independent callbacks, second-party verification, and secure delivery procedures, which measures were implemented, and which were inadequate, cannot be definitively judged based solely on criticisms from government officials or brief company statements.

Regarding incident notification, it is also necessary to obtain official records from the applicable data protection authority to confirm when Revolut became aware of the incident, when it completed the risk assessment, when it notified the regulatory authority, and when affected customers received the notification.

Regarding the whereabouts of the leaked data, the publicly available information is currently insufficient to prove whether the attackers have deleted all copies or whether the data has been transferred to others. Even if the attackers later claim to have deleted the files, reliable technical or investigative evidence is still required to support this claim; a unilateral promise cannot be taken as proof that the data has been completely recovered.

These questions are not simply a list of post-accident accountability measures. Each answer could potentially alter the determination of the cause of the accident and the responsibility for it.

If a bank has conducted thorough independent verification but still encounters highly sophisticated identity fraud, the incident raises the question of whether current verification methods are sufficient to protect against the risk of government communications accounts being compromised. If the investigation finds that the bank relies primarily on mailing addresses or document appearances, further examination is needed to determine whether its internal procedures comply with relevant laws and security requirements.

The same evidentiary requirements apply to government agencies. The reasons for account compromise, access control, detection of unusual logins, and the timing of incident discovery will influence how the outside world evaluates the security management of public communication systems.

Before the full investigation results are released, it is inappropriate to conclude that this incident was a case of unilateral negligence by a single bank, nor should it be simplified to an inevitable consequence of a government network intrusion.

The most reliable conclusion at present is that the attackers successfully exploited the trustworthy appearance of government communications identities to obtain customer information that should have been protected by the bank. How the government identities were verified, how the bank information was approved for delivery, and how cross-border legal procedures were carried out remain to be further investigated.

(Image caption) A file photo of the cover of a French passport. Revolut stated that it will cover the necessary costs for affected customers to replace their identity documents, but replacing the documents will not recover the copied personal data. The passport pictured is not one of the leaked documents belonging to the customer in this case.

The government's power also needs to be verified.

The most memorable number in the Revolut incident is 680, but it is not the only measure of the systemic impact of this incident.

The bank did not report a direct breach of its core systems, nor did it confirm that customer funds were transferred by attackers. However, the data of 680 customers was still leaked through what appeared to be a formal investigation process, highlighting an easily underestimated aspect of financial data protection: when external requests demand the appearance of government credence and legal documentation, how can the bank determine whether they truly have the legitimate authority?

This judgment cannot be entirely left to email systems, nor can it rely solely on document format. The authenticity of government communications, the legality of judicial authorization, the necessity of data requests, and the identity of the ultimate recipient all require a coordinated verification process.

For ordinary customers, the security of financial information is rarely a process they can monitor themselves. When they entrust their identity documents and financial information to banks, they typically have no idea what government requests the banks will receive afterward, nor can they verify under what legal procedures the information is disclosed. This trust needs to be shared by financial institutions and the public system.

The final legal responsibility for the Revolut incident remains to be investigated, but it has left a clear systemic question: banks can spend a lot of resources to verify the identity of their customers, but when someone requests customer information on behalf of the government, is there an equally reliable procedure to verify the other party?

In an era where cross-border finance increasingly relies on electronic documents and remote collaboration, this issue will affect more than just Revolut. Governments have the legal right to access financial information, and financial institutions must be able to verify that this right truly exists and is being exercised by the authorized person before fulfilling their cooperation obligations.

Disclaimer

This article is for news research and institutional analysis only and does not constitute legal or investment advice. Some facts are still under investigation; the ultimate responsibility of the parties involved shall be determined by the investigation of the competent authorities and the effective legal decision.