Revolut will pay for new IDs after sending 680 customers' data to a hijacked Italian police email

Banks are required to send customer data to authorities when asked as part of criminal investigations ^[11]. The attacker used that duty. Cossa-Dumurgier said Revolut's own systems had not been compromised ^[7]. That can be true while the data still left the bank. It went out in reply to what Revolut treated as legitimate official requests ^[2], sent from a police address that hackers had taken control of ^[12][8].

Piantedosi puts the failure on Revolut. He told lawmakers the bank could have and should have verified the request with minimal due diligence ^[13]. Cossa-Dumurgier said government agencies are sometimes the "weak link" in the system ^[7]. Both statements fit the record: the police lost control of a mailbox, and Revolut sent 680 customers' data to an address with no history of use ^[2][12].

Spread across those 680 customers, the roughly $3 million the group demanded ^[3] comes to about $4,400 a record ^[17], the price the group put on each one, or rather the price it asked for in public. Revolut says it will not pay ransoms ^[4]. "If they ever have to change their ID documents, we're taking care of the associated costs," Cossa-Dumurgier said ^[6]. She did not say whether any customer had yet changed a document or what the pledge could cost ^[9].

Revolut said it passed 70 million customers in January ^[16], so the 680 are roughly one customer in every 103,000 ^[18]. If none of them replaces a passport, the pledge costs nothing. If the records are published or sold, replacement stops being a choice for some of them and the pledge becomes a real expense. If Piantedosi's account stands, the lasting cost is a change to how Revolut vets official requests, starting with whether an address has ever been used before.

I think the third outcome is where the money goes. The pledge is limited to 680 people, while the request channel stays open to anyone who takes over a government mailbox. The view is wrong if the records turn up in fraud against those customers; then the replacements become the larger bill. Revolut is not arguing the point in public, and a spokesperson declined to comment on the minister's remarks ^[14].

The evidence covers one bank and one Italian police mailbox. Revolut is the only firm in it to have offered to pay for new identity documents ^[1].