Italian Police Probe Hacked Government Email Behind Revolut Data Leak

Italy’s Polizia Postale, the national cybercrime unit, has opened a formal investigation into the unauthorized use of a government-certified email account that hackers allegedly exploited to request and obtain customer data from Revolut. The government body linked to the account has denied ever sending such a request, leaving investigators to untangle how a supposedly trusted communications channel was turned into a tool for extracting sensitive financial information.

The case matters because it exposes a weak point not in Revolut’s own infrastructure, but in the legal and administrative plumbing that fintech companies are required to trust when responding to official requests. If a government email address can be hijacked to impersonate a legitimate authority, the consequences ripple far beyond one company’s customer list.

How Italy’s Certified Email System Became the Target

At the center of the investigation is Italy’s Posta Elettronica Certificata, or PEC, a certified email system that gives electronic messages the same legal standing as registered postal mail. Businesses, public agencies and professionals across Italy rely on PEC for everything from tax filings to formal legal notices, precisely because a message sent through the system is treated as verified and binding.

That legal weight is exactly what made the compromised account so useful to whoever accessed it. Some media reports tied the account to the Prefecture of Reggio Calabria, a provincial government office, though the prefecture has denied any involvement in the request sent to Revolut. Italy’s national cyber agency, CERT-AGID, had already flagged the underlying weakness months earlier. In June, the agency warned publicly that while PEC guarantees a message was delivered and by whom, it does not guarantee that the account sending it, or the content inside, has not been compromised. In other words, the system authenticates delivery, not integrity.

That distinction has proven costly. CERT-AGID says it has logged more than 650 cases of abused or illicit PEC accounts since the start of 2026 alone, a figure that suggests this is not an isolated incident but a pattern attackers have learned to exploit systematically against institutions that assume PEC messages can be taken at face value.

What It Means for Revolut and Its Customers

Revolut has said it reported the incident to the relevant authorities and maintains that its own systems, databases and customer funds were not compromised. That is a meaningful distinction: this was not a breach of Revolut’s servers but, according to the facts under investigation, a case of Revolut apparently acting on what looked like a legitimate legal request from an Italian government email account. If a fraudulent PEC message can be dressed up convincingly enough to extract customer data, the vulnerability lies as much in verification procedures at financial institutions as in the certified email system itself.

This is not the first time Revolut’s handling of official-looking requests has come under scrutiny. A separate incident, reported just days earlier, described attackers using a fake government domain to trick Revolut into leaking crypto customer data, a pattern detailed in a prior report on a fake government domain used against Revolut. Taken together, the two episodes point to a consistent tactic: rather than breaching encrypted systems directly, attackers are targeting the trust fintechs place in official-seeming correspondence.

The stakes are heightened by separate reports that attackers have threatened daily leaks of Revolut customer data, suggesting whoever obtained the information may be using it, or the threat of releasing it, as ongoing leverage. For customers, this raises the practical risk that personal and financial details tied to their accounts could circulate beyond Revolut’s control, even though the company insists its core infrastructure remains intact.

What Comes Next

The Polizia Postale investigation will need to establish exactly how the PEC account was compromised, who accessed it, and what data was ultimately handed over. Several concrete developments are worth watching in the coming weeks:

• Whether Italian authorities identify the specific method used to hijack the certified email account, and whether it matches the pattern behind the 650-plus other abused PEC cases logged this year.
• Whether CERT-AGID issues updated guidance or technical safeguards for PEC users following its June warning, given that the vulnerability it flagged appears to have materialized in a high-profile case.
• Whether Revolut faces regulatory scrutiny in Italy or elsewhere over its verification procedures for responding to government data requests, separate from the question of whether its own systems were secure.
• Whether the threatened daily leaks of customer data materialize, and if so, how Revolut and Italian authorities respond.

The episode arrives as European regulators more broadly tighten oversight of how crypto and fintech firms handle licensing and compliance, a trend visible in cases such as Deutsche Bank’s pending MiCA license for crypto custody. It also underscores a recurring theme in financial crime enforcement: attackers increasingly aim not at cryptographic defenses but at the administrative and legal channels institutions are obligated to trust, a dynamic echoed in unrelated enforcement actions like the DOJ’s charges against former Robinhood engineers over improper trading conduct. For now, the burden falls on Italian investigators to determine how a certified email account, designed to be the digital equivalent of registered mail, became a vector for fraud instead.

Source: Cointelegraph

This content is for informational purposes only and does not constitute financial or investment advice.