Revolut Data Leak via Compromised Italian Government PEC Accounts: Defending Against Fraudulent Law Enforcement Data Requests

In early 2026, fintech firm Revolut disclosed a data exposure affecting hundreds of its customers — and the root cause should alarm every organization that processes government or law enforcement data requests. Revolut's own systems were not breached. Instead, threat actors reportedly compromised a legitimate Italian government PEC (Posta Elettronica Certificata — Italy's certified email system) account and used it to impersonate law enforcement, submitting fraudulent data requests that Revolut processed in good faith. Because the requests originated from a genuine, trusted government channel, they passed the authenticity checks that would normally filter out spoofed correspondence.

This is the same class of attack that has plagued major technology and telecommunications firms through fraudulent Emergency Data Requests (EDRs) over the past several years — but with a critical escalation: rather than spoofing police domains or compromising a single officer's webmail, the actors here appear to have gained access to actual government-certified infrastructure, and the incident may be part of a broader compromise of Italian government systems. If your organization responds to legal process, court orders, or emergency disclosure requests — and most financial institutions, telecoms, SaaS providers, and healthcare entities do — this attack is directly relevant to you.

The defensive lesson is stark: identity assurance on the request channel is no longer sufficient. Trust anchored solely in "the email came from a real government account" is now an exploitable assumption.

Technical Analysis

What happened

Based on reporting from Security Affairs and Revolut's own statements:

Threat actors allegedly gained control of an Italian government PEC account. PEC is Italy's legally recognized certified email system, used by public administration and law enforcement for official correspondence. Messages sent via PEC carry legal evidentiary weight — which is precisely why they are trusted by recipients.
Using this compromised account, the actors impersonated law enforcement and submitted data disclosure requests to Revolut.
Revolut processed the requests and disclosed sensitive customer data affecting several hundred customers.
Revolut has confirmed its internal systems were not compromised — the failure was procedural trust exploitation, not a technical intrusion into Revolut infrastructure.
Investigators suspect the PEC compromise is part of a wider incident involving Italian government infrastructure, suggesting the actors may hold persistent access to additional certified accounts that could be reused against other organizations.

Why this attack works

This technique sits at the intersection of several MITRE ATT&CK tactics:

T1078 (Valid Accounts): The actors used a legitimate, credentialed government account. There is no malware, no exploit, no CVE — the vulnerability is the trust model itself.
T1656 / T1586 (Impersonation / Compromise Accounts): The channel's legal authenticity (PEC certification) was weaponized.
T1530 (Data from Cloud / Information Repositories): The objective is extraction of customer PII and financial data held by a third party.

The attack chain is deceptively simple:

Compromise a government email account (via phishing, credential theft, session token theft, or upstream infrastructure compromise — the initial vector remains under investigation).
Identify organizations that accept data requests from that channel (fintechs, telcos, social platforms, crypto exchanges are prime targets).
Craft a legally plausible request — typically an emergency disclosure request citing imminent threat to life, which bypasses standard judicial review timelines and pressures recipients to respond within hours.
Receive customer PII: names, addresses, account identifiers, transaction metadata, KYC documents.
Monetize via targeted fraud, account takeover, doxxing, or resale. In prior EDR abuse campaigns (e.g., those attributed to groups like LAPSUS$-adjacent actors), stolen data fueled SIM-swapping and extortion.

Exploitation status

This is confirmed active exploitation in the wild, with hundreds of confirmed victims at Revolut alone. Given the suspected breadth of the underlying Italian government infrastructure compromise, defenders should assume additional certified government accounts may be abused against other organizations in the coming weeks. There is no CVE — this is an identity-trust and process-integrity failure, not a patchable software flaw.

Why financial services and fintech are priority targets

High-value KYC data (government ID scans, proof of address) enables downstream identity fraud at scale.
Regulatory obligations (AML, PSD2) force rapid, good-faith cooperation with law enforcement — attackers exploit this compliance pressure.
EDR/LE request handling is often a small legal-operations team, not a security function, with limited tooling for request authentication.

Detection & Response

This is a technical threat — a confirmed campaign of government account compromise and social engineering against data-disclosure workflows. Detection must focus on two surfaces: (1) the inbound request channel, and (2) anomalous data access/export patterns by the teams processing these requests.

Sigma Rules

The following rules target observable behaviors: bulk customer-data exports consistent with disclosure fulfillment, and suspicious internal tooling access patterns. Tune thresholds to your environment's baseline.

YAML

---
title: Bulk Customer PII Export by Legal Operations or Support Account
id: 3f9c2a71-6b4d-4e58-9a21-8c7d5e2f10ab
status: experimental
description: Detects mass export or download of customer PII records by accounts associated with legal operations, compliance, or customer support — consistent with fulfillment of a fraudulent law enforcement data request. Baseline normal disclosure volumes before deployment.
references:
  - https://securityaffairs.com/199180/data-breach/revolut-data-leak-may-trace-back-to-compromised-italian-government-accounts.html
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.exfiltration
  - attack.t1530
logsource:
  category: application
  product: crm_or_customer_data_platform
detection:
  selection:
    event.action:
      - 'export'
      - 'bulk_download'
      - 'report_generate'
    record_count|gte: 50
  filter_baseline:
    user.role:
      - 'data_warehouse_analyst'
    change_ticket_exists: true
  condition: selection and not filter_baseline
falsepositives:
  - Scheduled regulatory reporting
  - Legitimate data migrations
level: high
---
title: Customer Record Access Outside Standard Disclosure Workflow
id: 8d2e5f43-1a9b-4c67-b3d8-5e6f7a8b9c0d
status: experimental
description: Detects customer data lookups performed without a corresponding approved case/ticket reference, or by users accessing records during unusual hours — an indicator that a disclosure request may not have followed legitimate workflow, or that an internal account is misused following fraudulent request pressure.
references:
  - https://securityaffairs.com/199180/data-breach/revolut-data-leak-may-trace-back-to-compromised-italian-government-accounts.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1078
logsource:
  category: application
  product: crm_or_customer_data_platform
detection:
  selection:
    event.action: 'customer_record_view'
    case_id: null
  selection_time:
    event.hour:
      - 0
      - 1
      - 2
      - 3
      - 4
      - 5
  condition: selection or selection_time
falsepositives:
  - Customer-initiated support interactions without tickets
  - On-call incident response
level: medium

KQL (Microsoft Sentinel / Defender)

Hunt for inbound emails claiming to be law enforcement or government legal requests that fail independent verification — including lookalike PEC sender anomalies and EDR-themed lures targeting your legal/compliance teams.

KQL — Microsoft Sentinel / Defender

// Hunt: Inbound emails referencing emergency data requests / legal disclosure
// targeting legal, compliance, or fraud teams — flag senders failing DMARC or
// first-time-seen domains for manual channel verification.
EmailEvents
| where TimeGenerated > ago(30d)
| where Subject has_any ("emergency data request", "EDR", "data disclosure", "court order", "exigent", "law enforcement request", "PEC", "posta certificata", "preservation request")
| join kind=leftouter (EmailUrlInfo | project NetworkMessageId, Url) on NetworkMessageId
| extend RecipientDept = tostring(split(RecipientEmailAddress, "@")[0])
| where RecipientDept has_any ("legal", "compliance", "fraud", "trust", "dpo", "privacy")
| project TimeGenerated, SenderFromAddress, SenderFromDomain, Subject, RecipientEmailAddress, Url, ThreatTypes, DeliveryAction
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Recipients = make_set(RecipientEmailAddress), Subjects = make_set(Subject) by SenderFromAddress, SenderFromDomain
| order by FirstSeen asc

KQL — Microsoft Sentinel / Defender

// Hunt: Anomalous SaaS customer-data export volume per user (Sentinel/Defender XDR)
// Detect spikes in data export/download activity by legal-ops or support identities.
CloudAppEvents
| where TimeGenerated > ago(14d)
| where ActionType in ("FileDownloaded", "FileSyncDownloadedFull", "ExportReport", "DownloadedItems")
| summarize ExportCount = count(), DistinctObjects = dcount(tostring(RawEventData.ObjectId)) by AccountDisplayName, AccountObjectId, bin(TimeGenerated, 1h)
| where ExportCount > 25
| order by ExportCount desc

Velociraptor VQL

For organizations that suspect an internal account may have been used to stage exported customer data locally before exfiltration, hunt for recent large CSV/XLSX exports in user profiles created around the incident window.

VQL — Velociraptor

-- Hunt for recently created bulk-export files (CSV/XLSX) in user directories
-- Adjust the timeframe to your incident window
LET export_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Downloads/*.csv', 'C:/Users/*/Downloads/*.xlsx', 'C:/Users/*/Desktop/*.csv', 'C:/Users/*/Documents/*.csv'])
WHERE Size > 100000
  AND Mtime > now() - 1209600
ORDER BY Mtime DESC

SELECT FullPath,
       Size,
       Mtime AS ModifiedTime,
       Btime AS CreatedTime,
       round(int=Size / 1048576, decimals=2) AS SizeMB
FROM export_files

Remediation / Verification Script

This PowerShell script helps M365-environment defenders audit mail flow for government-claiming senders and verify that external legal-request correspondence is flagged for independent verification. Adapt sender domains to the government channels your organization legitimately receives.

PowerShell

# ============================================================
# Legal Request Channel Integrity Audit — M365 / Exchange Online
# Run with ExchangeOnlineManagement module and appropriate role
# ============================================================

# 1) Find inbound messages referencing emergency/data-disclosure requests in the last 30 days
$start = (Get-Date).AddDays(-30)
$end = Get-Date
Get-MessageTrace -StartDate $start -EndDate $end |
  Where-Object { $_.Subject -match 'emergency|data request|disclosure|court order|exigent|PEC|law enforcement' } |
  Select-Object Received, SenderAddress, RecipientAddress, Subject, Status |
  Export-Csv -Path ".\LegalRequestMailAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# 2) Audit DMARC/DKIM/SPF authentication results for those senders (via Defender hunting or message headers)
# Pull detailed headers for any suspicious sender identified above:
# Get-MessageTraceDetail -MessageTraceId <id> -RecipientAddress <rcpt>

# 3) Create a transport rule flagging external legal-request-themed mail for verification banner
# (Review in the Exchange admin center before enabling — test in audit mode first)
New-TransportRule -Name "Flag External Legal Data Requests for Verification" `
  -SubjectOrBodyContainsWords "emergency data request","data disclosure","exigent","preservation request" `
  -FromScope NotInOrganization `
  -PrependSubject "[VERIFY VIA OUT-OF-BAND CHANNEL] " `
  -Mode Audit

# 4) Verify your disclosure portal enforces MFA + ticket linkage for exports
# Confirm Conditional Access policies cover the legal-ops/compliance groups:
Get-MgIdentityConditionalAccessPolicy | `
  Select-Object DisplayName, State, @{n='IncludedGroups';e={$_.Conditions.Users.IncludeGroups}} |
  Format-Table -AutoSize

Remediation

Because there is no software patch for a trust-model failure, remediation is procedural and architectural. Prioritize the following:

1. Implement out-of-band verification for every data disclosure request

Never fulfill a law enforcement or government data request based solely on the originating email account — even certified systems like PEC, or domains like .gov / police.* equivalents.
Require independent callback verification: look up the agency's published contact number (never use contact details contained in the request itself), confirm the case number and requesting officer with the agency's duty desk.
For Italian/EU channels: cross-verify PEC senders against the official INI-PEC registry and confirm with the agency via a second channel. Treat any deviation in the sender's PEC address as hostile.
For US-style EDRs: use established verification portals (e.g., Kodex, or vendor-operated LE portals with enrolled, authenticated officers) rather than ad-hoc email.

2. Remove the "emergency" bypass loophole

Emergency requests exist to save lives — attackers exploit precisely this urgency. Require two-person authorization for any emergency disclosure, and mandate post-hoc verification with the requesting agency within 24–72 hours, with clawback/notification procedures if the request proves fraudulent.
Maintain a register of verified agency request templates and known-officer identities; flag deviations.

3. Instrument the disclosure workflow for detection

Log every customer-record access tied to a legal request with a mandatory case/ticket ID (the Sigma and KQL content above depends on this telemetry existing).
Alert on export volume anomalies per user and per case; a fraudulent campaign typically requests data on many victims at once or submits repeated requests across days.
Feed legal-ops mailbox traffic into your email security stack with the same scrutiny as finance mailboxes (BEC-style controls).

4. Notify and support affected customers aggressively

Revolut's exposure includes PII that can fuel targeted phishing, SIM-swapping, and identity fraud. If you experience a similar event: notify victims promptly, offer credential/session resets and enhanced monitoring, and brief your fraud team on likely follow-on social engineering against those customers.

5. Treat government-channel compromise as a sector-wide threat

If reporting confirms broader compromise of Italian government PEC infrastructure, temporarily elevate verification requirements for all requests originating from that channel until authorities confirm containment. Subscribe to advisories from the relevant national CERT (CERT-Italia / ACN) and your FS-ISAC or sector ISAC for updated indicators.
Brief your legal, compliance, and trust-and-safety teams on this campaign specifically — they are the attack surface, and a 20-minute briefing on callback verification is the single highest-ROI control available.

6. Regulatory and contractual review

A disclosure made to a fraudulent requester is still a personal data breach under GDPR — engage your DPO, assess notification obligations (72-hour supervisory authority clock), and document the verification failures and corrective actions.
Review vendor/processor agreements that touch your customer data for their own law-enforcement-request handling procedures.

The uncomfortable truth from this incident: your security perimeter can be flawless, and your customers' data can still walk out the door through a legally sanctioned, well-intentioned process. Harden the process, not just the platform.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub