A compromised government email account pulled about 680 customer files out of Revolut over months

The control that failed is the one that reads a legal demand and decides whether the authority behind it is real. Revolut's checks looked at the sender, and the sender was an email account on a genuine government-agency domain ^[2]. The messages passed as official legal demands and the bank answered them over a period of months ^[3]. The duration matters more than the first request: the queue kept answering one address for months, and the check it ran each time stopped at the sender ^[11].

Roughly 680 customers were affected, according to a person familiar with the matter ^[4], and the public demand was about $3 million in Monero inside 24 hours ^[5]: about $4,400 a customer ^[21]. Revolut says no funds were taken and that its systems, databases and customer accounts were not penetrated ^[15][14]. The $3 million buys a promise not to resell the files to other criminal groups ^[5].

Many of the accounts appear to have been picked because of suspected cryptocurrency activity ^[6]. The group told the Financial Times it chose targets through blockchain analysis and had used a compromised Italian government email system to pose as law enforcement ^[8]. The material that left the company included passport and driving licence copies, verification photographs, IBANs and transaction histories with Bitcoin activity ^[7]. Per the report, the practical danger for those customers is targeted fraud or further extortion attempts, and that danger sits outside whatever Revolut decides about the payment ^[20].

The report points to how financial firms check the substance of legal demands even when the sending infrastructure looks genuine ^[12]. Regulated firms have to answer legitimate government and law-enforcement requests ^[10]. That leaves one place to add a check: an out-of-band callback on every demand, paid for in compliance handling time.

If Revolut pays nothing and the records circulate, the cost falls on those 680 people and on the Italian authorities now examining the compromise of the government email accounts ^[18]. The regulators the bank notified itself, data-protection authorities and financial supervisors among them ^[9], could instead treat a months-long response window as a control failure. Then the number stops being $3 million and becomes whatever they assess. A third possibility is that the group holds less than it says.

In my view the supervisory question is the more expensive one. The money named in the public countdown is $3 million ^[5], while the response window the bank has already reported to its own regulators is measured in months ^[3][9]. A supervisory finding that answering an authenticated government domain met the standard of care would prove that wrong. It would move the failure onto Italy's compromised email accounts ^[18].