Hackers claim attack on Revolut using prefecture PEC email
Italy is investigating suspected fraud against British digital bank Revolut: cybercriminals allegedly used the certified email address of a unit of the Reggio Calabria Prefecture to obtain customers’ personal data. As ANSA English reports, the hacker group also claimed to possess data belonging to Italian law enforcement agencies.
According to the Financial Times, the attackers were provided with data on 680 Revolut customers, including passport details, addresses, bank account numbers and records of bitcoin transactions. The publication reported that the request for this information came from the certified PEC address of a unit of the Reggio Calabria Prefecture.
Bank and regulator response
A Revolut spokesperson said that the bank’s systems and customers’ funds were not affected. According to the spokesperson, after detecting the incident, the bank blocked the address from which the request had come and notified the relevant government body, law enforcement, data protection authorities and financial regulators.
More current news is available on the UA.News Telegram channel Telegram.
The UK Information Commissioner’s Office is also investigating the data breach. Italian consumer association Codacons called on the competent authorities to establish the scale of the incident, check whether Italian institutions had been compromised and determine which PEC accounts may have been used to obtain confidential information.
Hackers’ claims and investigation
The iamnotavillain group, which the Financial Times contacted via Telegram, claimed responsibility for the incident. Its representatives say they obtained confidential data on nearly 700 customers after compromising a certified email system belonging to Italy’s Interior Ministry. They also claimed to possess about 147 gigabytes of internal data from Italian law enforcement agencies.
According to ANSA, the attackers allegedly impersonated officials for several months and requested customers’ addresses, phone numbers and transaction histories from the bank. The National Directorate for Anti-Mafia and Counter-Terrorism has joined the investigation. Law enforcement officers are determining whether the prefecture’s PEC account was compromised or cloned, and are also checking the darknet for a possible sale of Revolut customer data.
