A hacker who goes by the alias IAmNotAVillain says the Revolut data breach that Financial Times, TechCrunch, and Reuters reported on September 12, 2026, was only the opening chapter. Reuters put the number of affected customers at roughly 680 and reported that the attacker threatened to resell the stolen records within 24 hours if Revolut did not meet the ransom demand. In new claims surfacing on September 15, the same actor says they spent six months inside multiple Italian law-enforcement systems, walked away with roughly 147GB of internal Italian police material, and used a hijacked government email account to trick Revolut into handing over records on nearly 700 high-value crypto customers. Revolut disputes the scale of the Italian systems claim. Italian authorities said on September 18, 2026 that a certified email address associated with the Prefecture of Reggio Calabria had been used to obtain data on 680 Revolut customers, but the 147GB claim itself has not been confirmed.
The story matters beyond one fintech’s bad week. It exposes a soft spot that almost every regulated company shares: the near-total trust placed in official government email addresses, especially ones sitting on Italy’s legally binding PEC (Posta Elettronica Certificata) certified-mail system. If a fraudster can borrow that trust for a single afternoon, they can bypass identity checks that took years and millions of dollars to build.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What happened, according to named outlets
Revolut confirms the disclosure
Revolut confirmed on September 12, 2026 that it had disclosed sensitive customer information to an unauthorized third party after receiving what it called fraudulent information requests sent from a legitimate government agency email domain, according to TechCrunch and Reuters, which initially described the incident as affecting only a “limited” number of customers, a characterization The Irish Times also reported Revolut used in its first public statement on the matter. That framing did not hold for long: Cryptobriefing and follow-up reporting from the Financial Times, relayed by Yahoo Finance, put the number of affected clients at nearly 700, Financial Times sources separately cited roughly 680 compromised accounts, and SecurityWeek’s September 17, 2026 report converged on that same approximate figure, with most outlets settling on a range of 680 to 700 customers.
The compromised @interno.it channel
The compromised channel was traced to the @interno.it domain, tied to Italy’s Ministry of Interior (Viminale), with some reporting pointing specifically to a sender on the pec.interno.it PEC address, according to Cybersecurity News and Italian outlets covering the story. PEC is not an ordinary inbox. It is Italy’s certified email standard, treated as legally equivalent to registered postal mail and used by government bodies, courts, and law firms for binding official communication. That legal weight is exactly what made the fraudulent request believable enough for Revolut’s compliance team to act on it. Italian authorities said on September 18, 2026 that data on 680 customers had been sent to a certified email address belonging to, or purporting to belong to, the Prefecture of Reggio Calabria.
How the emails passed authentication
Security researchers examining the incident say the messages passed Revolut’s SPF, DKIM, and DMARC authentication checks because they genuinely originated from the government domain, not a lookalike. In other words, this wasn’t a spoofed sender header that a spam filter should have caught. Someone had operational access to a real, authenticated government mailbox. That distinction matters for defenders: no email-security gateway or authentication check would have flagged this message as fraudulent, because on every technical measure available to Revolut’s systems, it wasn’t.
The escalation: 147GB and a claimed six-month intrusion
Revolut’s initial framing collapses
The September 12 disclosure was framed by Revolut as a contained, one-off impersonation scam. That framing came under pressure three days later. On September 15, the threat actor IAmNotAVillain told researchers monitoring the case, including the account International Cyber Digest, that the Revolut operation was one output of a much longer campaign, according to reporting from IT-Connect and Cybersecurity News. The hacker claims to have held access to multiple departments of the Italian police for approximately six months and to be sitting on roughly 147GB of internal Italian law-enforcement material, including internal documents, calendars, and personal files.
Conflicting file counts: 688 files vs. 36,393 files
The file counts attached to that claim have shifted as the story developed. An early screenshot circulated by the hacker showed 688 files across 204 folders, per Cybersecurity News. A later claim reported by IT-Connect put the figure far higher, at 36,393 files spread across 5,223 folders. Neither figure has been independently verified by Revolut, Italy’s Interior Ministry, Italy’s national cybersecurity agency (ACN), or Italian police. Italian commentary outlets, including Il Foglio, have described the alleged use of the PEC system as a “Trojan horse,” warning that any single compromised certified-mail account creates outsized downstream risk precisely because so many private companies treat PEC messages as automatically authoritative. The jump between the two published counts, from 688 files to 36,393, is more than 50-fold, and is itself worth noting: threat actors marketing a data leak have a financial incentive to inflate figures as negotiations stall, since a bigger number sustains media attention and pressure on the victim even without new evidence. Reports on September 25, 2026 described roughly 85,000 files in an “Italy files” folder, but the complete dataset was not publicly downloadable at that time. No independent forensic review has said which count, if any, reflects the actual volume of stolen material.
Two claims, one confirmed
It is worth separating two different claims that have gotten blended together in social coverage of this story. The first: a real government email address was used to extract real customer data from Revolut. That part is confirmed by Revolut itself. The second: the same actor separately breached deep into Italian law-enforcement infrastructure for half a year. That part remains an unverified assertion from the attacker, repeated by researchers monitoring the leak but not confirmed by any government body.
Who was targeted, and what data got out
A targeted, not broad, customer sweep
The victims were not random Revolut users. Reporting from multiple outlets describes the targets as high-net-worth customers, many involved in crypto asset businesses, colloquially termed “crypto whales.” A crypto investigator known as ZachXBT, cited by Cybersecurity News, assessed that the operation was deliberately aimed at high-net-worth users rather than a broad customer sweep.
What data was exposed
The exposed data package, according to reporting aggregated by CryptoTimes and IT-Connect, included names, dates of birth, occupations, postal and email addresses, phone numbers, copies of passports and driver’s licenses, the identity-verification selfies Revolut requires during KYC onboarding, bank statements, full transaction histories, IBANs, and Bitcoin transaction records; TechCrunch separately confirmed that passports and driver’s licenses were among the exposed documents, while CoinDesk reported that leaked Bitcoin transaction histories were among the most sensitive items circulating on Telegram, a list Revolut itself effectively corroborated on September 14, 2026, when RTÃ reported the company had said exposed records could include passports and driving licences alongside dates of birth, addresses, emails, and phone numbers. International Cyber Digest posts cited by IT-Connect indicate most affected customers are based in Switzerland and France, with additional records tied to residents of roughly 30 countries in total, including Cyprus, Portugal, Germany, Spain, Bulgaria, Czechia, Romania, Poland, Malta, Norway, and Sweden, while RTÃ reported on September 15, 2026 that about 12 Irish customers were among the roughly 680 affected globally. The Italian Interior Ministry said that eight of the 680 customers were Italian, according to reporting published on September 25, 2026.
Unverified individual claims
Some reporting has named individuals allegedly among the affected customers, including a tennis player and a professional footballer, along with a crypto casino executive, though tech-insider.org is not independently confirming those individual identifications and treats them as unverified claims sourced to social-media leak monitoring rather than Revolut disclosures. The gap between named individual claims and confirmed reporting is a recurring feature of high-profile leaks: leak-monitoring accounts have an incentive to name recognizable individuals to drive engagement, while outlets with editorial standards wait for corroboration that, in many cases, never arrives.
The extortion demand
A 10,000 BTC asking price
The attacker is not simply sitting on the data. According to CryptoTimes and IT-Connect, IAmNotAVillain has demanded 10,000 bitcoin, worth roughly âŽ673 million at the exchange rate reported at the time, threatening to keep publishing customer records on Telegram for as long as Revolut refuses to pay, with Reuters separately reporting that the attacker threatened to resell the stolen dataset within 24 hours absent payment. Identity documents and verification selfies tied to the KYC process have already been posted publicly as proof of the breach, a pressure tactic common in modern extortion-style data leaks where the goal is reputational damage rather than direct account takeover.
Financial Times reporting puts the figure at $3 million
On September 17, 2026, reporting citing the Financial Times described the extortion demand differently, putting the figure at $3 million rather than 10,000 bitcoin, a figure Reuters also carried in its own coverage sourced to the Financial Times’ reporting. CryptoTimes and IT-Connect continued reporting the 10,000 BTC figure in the same window, and the Financial Times is the common named source running through most of the later coverage of this story. Financial Times reporting has been the throughline for this story since it first surfaced the Italian law-enforcement claim, which is one reason later aggregators and crypto-focused outlets continued to cite it directly rather than attribute the $3 million figure to their own reporting. Later reporting links the two numbers: it says the group demanded 6,000 Monero, then valued at roughly US$3 million, from Revolut, and describes the 10,000 bitcoin as another, earlier reported demand. Reports citing the Financial Times said the attackers cut the ransom to about $3M and set a 24-hour deadline to sell 680 customer files, and the demand and countdown are the actor’s own. Readers should still treat both the $3 million and 10,000 BTC figures as reported asking prices, not confirmed terms.
No confirmed payment
There is no reporting from any named outlet confirming that Revolut has paid, or intends to pay, any part of either demand. Both the $3 million and 10,000 BTC figures should be read strictly as reported asking prices, not a negotiated or accepted sum.
Revolut’s response
The official line: impersonation, not intrusion
Revolut has consistently characterized the incident as what the company describes as a sophisticated external impersonation scam, emphasizing that its own technical infrastructure and customer funds were not affected, according to statements relayed by Reuters and Italian outlets covering the disclosure. A company spokesperson told Reuters that upon detection, Revolut immediately blocked the address and alerted the relevant government agency as well as enforcement agencies, data protection authorities, and financial regulators. The company has said it contacted affected customers directly.
UK regulatory scrutiny opens
CryptoTimes reported on September 15 that UK regulators have opened scrutiny into the incident, consistent with Revolut’s UK banking license and its obligations under British data protection rules, though the exact scope and formal status of that review has not been detailed in available reporting. That scrutiny has only intensified since: RTÃ reported on September 24, 2026 that Revolut faced a second, separate data incident that same month, this one involving its brokerage partner DriveWealth, which The Register reported had exposed historical personal data on customers, adding pressure on regulators to examine how the company vets and shares customer data with third-party partners.
The claim Revolut hasn’t addressed
What Revolut has not done, based on available reporting, is confirm the attacker’s broader claim about a six-month Italian law-enforcement compromise. That silence is doing a lot of work in this story. Revolut has every incentive to frame the incident narrowly, as a single fraudulent-request event it could not have prevented through its own security controls, rather than as evidence of a state-adjacent security failure it has no way to independently verify or refute.
Why trusted-channel attacks are so hard to stop
A process attackers can’t resist targeting
Most large-scale breaches covered on this site involve a technical exploit: an unpatched server, a leaked credential, a vulnerable API. This incident is different, and in some ways more unsettling, because Revolut’s technology reportedly worked exactly as designed. The emails came from a real domain. They passed real authentication checks. A human reviewer, following a legitimate legal-request process that regulated fintechs are required to maintain, approved what looked like a lawful law-enforcement data request.
The verification speed trade-off
That is the structural problem with law-enforcement request abuse: it exploits a process companies are legally obligated to maintain and respond to promptly. Slow down every government data request for manual, multi-day verification, and a company risks obstructing real investigations and drawing regulatory penalties. Fast-track them, and a single compromised or borrowed government mailbox becomes a skeleton key. Fintechs, cloud providers, and telecoms handling large volumes of law-enforcement requests face this tension constantly, and this incident shows what happens when the trust gets exploited at scale.
Historical context: this keeps happening
Apple, Meta, and Discord faced the same trick
Fake law-enforcement data requests, sometimes called Emergency Data Request (EDR) fraud in US contexts, are not new. US tech companies including Apple, Meta, and Discord have previously disclosed handing over user data to hackers who compromised or impersonated police and government email accounts, exploiting the same urgency-driven trust that legitimate emergency legal process depends on. In those earlier cases, the pattern was consistent: a request arrived through a channel the receiving company had no practical way to instantly verify, carried the implicit threat that delay could mean withholding information from a live emergency, and asked for exactly the kind of account and identity data that turns out to be reusable for further fraud once exposed.
What’s different about the Italian PEC angle
What sets the Revolut case apart is the apparent use of Italy’s PEC certified-mail infrastructure specifically, a system designed to carry more legal weight than a typical government email address, which may explain why Revolut’s compliance process treated the request as more authoritative than a standard inbound email.
tech-insider.org covered Revolut’s initial September 12 disclosure as the story broke. This report focuses on what has changed since: the escalated 147GB Italian law-enforcement claim, the extortion demand reported as $3 million by the Financial Times and separately as 10,000 BTC by other outlets, and the widening list of affected countries that emerged in the days that followed.
Market and industry impact
IPO timing risk
Revolut has been preparing for a stock market listing and has courted a premium valuation built partly on its reputation as a modern, security-conscious challenger bank serving over 65 million customers globally, according to the company’s own public statements. A breach narrative involving KYC documents, passport scans, and cryptocurrency transaction histories for its wealthiest crypto-holding customers is precisely the kind of story that unsettles institutional investors evaluating fintech IPO candidates, even when the root cause sits outside the company’s own infrastructure. Institutional investors pricing an IPO typically weigh operational and reputational risk as part of due diligence, and a breach narrative that surfaces while a listing is still being prepared tends to invite sharper questions about internal controls than the same incident would once shares are already trading and the market has had time to price the risk in.
Compliance teams across the sector are watching
For the wider fintech and crypto-custody sector, the incident is likely to accelerate scrutiny of how exchanges, neobanks, and custodians verify inbound law-enforcement requests. Expect compliance teams at comparable firms, including Revolut’s direct neobank competitors, to quietly review or tighten their own legal-request intake procedures in the coming weeks, even without a public announcement. For companies outside the fintech sector that still field law-enforcement data requests, most notably cloud providers, telecoms, and social platforms, the incident is a reminder that request volume and urgency are not proxies for legitimacy, and that a single successfully impersonated official channel can outweigh years of otherwise solid identity-verification engineering.
How this compares to other 2026 government-trust breaches
The Revolut case sits alongside a string of 2026 incidents in which attackers weaponized trust in official or verified channels rather than breaking through a firewall. The table below places it against other notable data-exposure events this year, based strictly on figures reported by the outlets covering each incident.
| Incident | Vector | Records / customers affected | Reported ransom / demand |
|---|---|---|---|
| Revolut / Italian government email (Sept 2026) | Impersonated government law-enforcement email request | ~680-700 customers (crypto whales) | 10,000 BTC (~âŽ673M) per CryptoTimes/IT-Connect, or $3M per later FT-sourced reporting (Sept 17) |
| IDScan.net breach | Compromised ID verification vendor | ~150-153 million IDs, per prior tech-insider.org reporting | Not publicly disclosed |
| Trezor / Brevo phishing breach | Third-party mailing vendor compromise | ~347,000 crypto owners, per prior tech-insider.org reporting | Not publicly disclosed |
| Florida DMV breach | Compromised officer personal device | ~200,000 IDs, per prior tech-insider.org reporting | Extortion deadline reported, no confirmed payment |
The common thread is not a software vulnerability. It is misplaced trust in a verification layer, whether that layer is a government email domain, a KYC vendor’s credential store, or a mailing-list provider’s admin panel. Attackers in 2026 have increasingly learned that the fastest way to a bank’s customer data is not to break its systems, but to convince its compliance team that a request is legitimate.
Timeline of the Revolut breach
| Date | Event |
|---|---|
| Sept 11-12, 2026 | Fraudulent data requests sent and processed via the compromised Italian government email domain, per Cryptobriefing and Kelacyber |
| Sept 12, 2026 | Revolut publicly confirms the disclosure, calling it an external impersonation scam; Reuters, Bloomberg, and TechCrunch report the story |
| Sept 13-14, 2026 | Financial Times reporting, relayed by Yahoo Finance, puts affected customers at nearly 700; extortion and Telegram leak activity begins |
| Sept 15, 2026 | Hacker IAmNotAVillain claims six months of access to Italian law-enforcement systems and 147GB of stolen material; Financial Times publishes “Hackers say they breached Italian state email to target Revolut ‘crypto whales'”; CryptoTimes reports UK regulatory scrutiny and the 10,000 BTC demand |
| Sept 17, 2026 | Reporting citing the Financial Times says the attackers cut the ransom to about $3M, set at 6,000 Monero, and gave a 24-hour deadline to sell 680 customer files; 10,000 bitcoin was an earlier reported demand |
What Italian authorities have and haven’t confirmed
On September 18, 2026, Italy’s Interior Ministry confirmed that a certified email address associated with the Prefecture of Reggio Calabria had been used to obtain data on 680 Revolut customers. The ministry, the Postal Police and the publicly described investigation have not confirmed the broader claim, and publicly available reporting says there is no confirmed evidence that the central systems of the Interior Ministry were breached or that the alleged 147 GB were exfiltrated from them. That leaves the 147GB and six-month access claims resting on the attacker’s own statements and analysis from independent researchers monitoring leaked file samples. Readers should treat the broader Italian law-enforcement compromise claim as unverified until an official body confirms or refutes it.
Where the Italian Investigation Stands
Interior Minister Matteo Piantedosi addressed the email-address question on September 30, 2026, saying the address used to obtain Revolut customer data appeared connected to the Reggio Calabria police email system but had never been used before. The Postal Police’s Cybersecurity Operations Center informed the Reggio Calabria Public Prosecutor’s Office and began investigative activity. Reporting on Postal Police checks said no breach had been detected in ministry systems and no law-enforcement data had been shown to have been taken from the Interior Ministry network.
The systems and bodies specifically identifiable in the available reporting are the Polizia di Stato, the Polizia Postale, the Centro operativo per la sicurezza cibernetica, the ACN, the Prefettura di Reggio Calabria, and the Procura della Repubblica di Reggio Calabria. On September 25, 2026, the group published previews of files it attributed to Italian public bodies, including the Interior and Justice Ministries. Reports described roughly 85,000 files in an “Italy files” folder, but the complete dataset was not publicly downloadable at that time.
For readers following the story, the practical distinction is between what is documented and what is only claimed. The transfer of customer data to a certified email address is the documented part, and it is the part that affects Revolut customers directly. The 147 GB volume, the file totals and the claimed access to Italian systems remain the attacker’s assertions, and publishing previews does not by itself prove them. It is not currently supportable to state that the Italian Interior Ministry suffered a confirmed 147 GB breach.
What happens next: predictions
- Expect Revolut to face formal regulatory inquiries in multiple jurisdictions beyond the UK, given that affected customers span roughly 30 countries according to leak-monitoring reports, likely triggering GDPR notification obligations across the EU.
- Watch for further official statements from Italy’s Interior Ministry or ACN. The ministry confirmed on September 18, 2026 that a certified email address tied to the Prefecture of Reggio Calabria was used to obtain data on 680 Revolut customers, and Interior Minister Matteo Piantedosi addressed the address on September 30, 2026, but the 147 GB claim remains unconfirmed.
- Other fintechs and exchanges handling law-enforcement data requests will likely tighten manual verification steps for urgent government requests in the coming weeks, even without public announcements.
- The ransom demand, reported as either $3 million or 10,000 BTC depending on the outlet, is unlikely to be paid outright; expect continued incremental data leaks on Telegram as pressure tactics rather than a lump-sum resolution.
- Treat the ransom figures as reconciled: reporting describes a demand of 6,000 Monero, valued at roughly US$3 million, with 10,000 bitcoin as an earlier reported demand. The demand is the attackers’ own claim, not a confirmed term.
- If the 147GB Italian law-enforcement claim is eventually substantiated, expect scrutiny to shift toward Italy’s PEC certified-mail infrastructure and whether other agencies relying on it face similar exposure.
What Revolut customers should do now
Revolut has said it is contacting affected customers directly, but given how identity documents were exposed, anyone concerned should independently watch for signs of identity misuse. That includes monitoring for new accounts opened using leaked passport or driver’s license data, enabling additional authentication on any linked crypto exchange accounts, and treating any inbound communication claiming to be from Revolut, a government agency, or law enforcement referencing this breach with extra skepticism, since the same social-engineering pattern that fooled Revolut’s own compliance team could be reused against individual customers in follow-up phishing attempts.
What this means for the crypto custody industry
Crypto-holding customers of any regulated fintech occupy an unusual risk position. They are subject to the same KYC and AML disclosure requirements as any bank customer, meaning their identity documents and transaction histories sit inside conventional financial-services infrastructure, while the assets those records point to are, unlike a traditional bank balance, often irreversible once moved. That combination makes “crypto whale” customer files an unusually attractive target: the data unlocks identity fraud opportunities typical of any breach, plus a direct map of who holds enough digital assets to make a targeted extortion, SIM-swap, or physical security threat worthwhile.
Frequently asked questions
What is the Revolut Italian government email breach?
Hackers used a legitimate Italian government email address, reportedly on the interno.it domain tied to Italy’s Ministry of Interior, to send fraudulent law-enforcement-style data requests to Revolut. Revolut confirmed on September 12, 2026 that it disclosed sensitive customer data to an unauthorized third party as a result.
How many Revolut customers were affected?
Reporting from the Financial Times, relayed by Yahoo Finance, and corroborated by Cryptobriefing and CryptoTimes, puts the number at roughly 680 to nearly 700 customers, described as high-net-worth “crypto whale” clients.
Who is IAmNotAVillain?
IAmNotAVillain is the online alias used by the threat actor claiming responsibility for the Revolut data theft. The same actor claims separately to have accessed multiple Italian law-enforcement departments for roughly six months and to hold about 147GB of internal Italian police data, a claim that remains unverified by any government body.
Did hackers actually breach Italian law enforcement systems?
That is not confirmed. It is an unverified claim made by the attacker and repeated by researchers monitoring leaked file samples. Italy’s Interior Ministry confirmed on September 18, 2026 that a certified email address associated with the Prefecture of Reggio Calabria was used to obtain data on 680 Revolut customers, but the ministry and the Postal Police have not confirmed the broader 147GB claim.
What data was exposed in the Revolut breach?
According to CryptoTimes and IT-Connect, exposed data included names, dates of birth, occupations, addresses, phone numbers, passport and driver’s license copies, KYC verification selfies, bank statements, full transaction histories, IBANs, and Bitcoin transaction records.
How much ransom are the hackers demanding?
Reporting has varied. CryptoTimes and IT-Connect cite a demand of 10,000 bitcoin, worth roughly âŽ673 million at the exchange rate reported at the time, while later coverage citing the Financial Times on September 17, 2026, put the figure at $3 million. There is no confirmed reporting that Revolut has paid any part of either demand.
Why do reports disagree on the ransom amount?
Coverage has split between a $3 million figure, reported via the Financial Times on September 17, 2026, and a 10,000 BTC figure reported earlier by CryptoTimes and IT-Connect. Later reporting says the group demanded 6,000 Monero, then valued at roughly US$3 million, and describes 10,000 bitcoin as an earlier reported demand, but neither Revolut nor the attacker has publicly confirmed which figure reflects the actual current demand.
Was Revolut’s own security infrastructure hacked?
Revolut says no. The company describes the incident as an external impersonation scam and states that its technical systems and customer funds were not compromised, characterizing the breach as fraudulent misuse of a legitimate government email channel rather than a direct intrusion into Revolut’s own servers.
What should affected Revolut customers do?
Revolut says it is contacting affected customers directly. Customers with exposed identity documents should watch for signs of identity misuse, add extra authentication on linked crypto accounts, and treat unexpected messages referencing this breach, even ones appearing to come from government or law-enforcement senders, with heightened skepticism.
