Revolut under investigation for data breach via compromised institutional PEC

The Public Prosecutor's Office of Reggio Calabria has opened an investigation into the case of the UK banking services company Revolut, from which hackers requested and obtained customer data using a compromised institutional email belonging to the Prefecture of Reggio Calabria. The hypothesized crime is 615 ter paragraph 3 of the penal code, i.e. intrusion into a computer system of public interest. The National Anti-Mafia and Anti-Terrorism Directorate was also activated in the case and intervenes when the violation concerns a government body. The first information from the Postal Police gives an account of a very sophisticated action. We are trying to understand whether the prefecture's certified email was 'pierced' or cloned.

The claim

A group of hackers calling themselves "iamnotavillain", contacted by the Financial Times via Telegram, have claimed responsibility for the breach of the British digital bank Revolut, claiming to have obtained confidential data of almost 700 customers after compromising a certified email system of the Italian Interior Ministry. The group said it possesses approximately 147 gigabytes of internal Italian law enforcement data. For months they would pose as agents, asking the bank for addresses, telephone numbers and transaction histories.

The Privacy Guarantor

the Privacy Authority has prepared an immediate check on any flaws in the access security of Italian banks, both to ascertain whether there have been other cases of attempted infiltration (as in the Revolut affair), and to call banking institutions to carry out effective internal control. A communication has been sent from the offices of the Guarantor Authority to the network of data protection managers (DPO) of the banking institutions, inviting them to proceed with a diligent internal check of their systems and, in the case of confirmed flaws, to contact the Authority immediately. The Guarantor Authority has also promoted an action with the Lithuanian counterpart Authority (where Revolut's main registered office is located), communicating the information held by the Italian Guarantor, and inviting an exchange of information, so as to strengthen the enforcement action. Furthermore, the Authority has moved towards the Ministry of the Interior to look into the Revolut affair in more depth and ascertain whether there are other banks or financial institutions involved, limiting the damage that has occurred and bringing to light how many and which data have been compromised.

In-depth analysis

Revolut, scam with Italian certified email compromised: 680 customer data exposed