Technology and Science16 September, 20262 min read
Italy Investigates Government Email Breach Linked to Revolut Data Leak
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Italian cybercrime police probe linked Revolut data leak after hackers used legitimate government email accounts. Authorities identified over 650 cases of abused or illicit certified government emails.
PEC Email Impersonation
Italian authorities opened an investigation into a government email breach linked to Revolut after hackers allegedly used a compromised certified email account to obtain sensitive customer information. Polizia Postale, Italy’s cybercrime police, is investigating the incident for alleged unauthorized access to a computer system and computer fraud, Italian news agency ANSA reported on Tuesday.
Revolut said it reported the issue to Italian authorities upon detection and that its systems, databases and customer funds remained secure, while the compromised account was reportedly part of Italy’s Posta Elettronica Certificata (PEC) system. Italy’s CERT-AGID cybersecurity agency warned in June that PEC certifies delivery but does not guarantee the security of a message’s content, and it said it had handled more than 650 cases involving abused or illicit PEC accounts since the start of 2026.
680 Customers Notified
Revolut’s breach response described the incident as a targeted impersonation scam in which an unauthorized third party used a legitimate email address of a government agency to send fraudulent information requests.
The Financial Times reported that Revolut contacted 680 people, and Il Fatto Quotidiano said the data handed to the criminals included passports, identity documents, banking data, home addresses, Bitcoin transaction history, and identity verification photos.
Revolut told the Financial Times that its systems and customers’ funds were not affected and that it had “immediately blocked the email address” used to carry out the scam.
Mark Karpelès, former CEO of Mt. Gox, told the Financial Times that he received an email from Revolut at 5:25 a.m. on September 12 to warn him about the scam and the risks to compromised data.
Regulatory Scrutiny and Risk
The UK’s Information Commissioner’s Office opened an investigation after Revolut’s complaint to the oversight body, and the Financial Times said the episode involved blackmail in which the criminals demanded a ransom or threatened to make customers’ data public. Il Fatto Quotidiano reported that Revolut’s valuation was 115 billion and that the company reassured about the solidity of its IT systems while emphasizing that the incident was not a hack to break through cyber protections.
Cointelegraph reported that Revolut declined to identify the government agency whose email was allegedly compromised, citing an active police investigation and confidentiality obligations. In Italy, CERT-AGID’s warning that PEC certifies delivery but does not guarantee message security, alongside its statement of more than 650 cases handled since the start of 2026, frames the stakes for how certified email channels are abused even when internal systems are not breached.