Revolut
How they got in, as reported. Email made to look like it came from a trusted sender.
← All cases- Date
- 21 Sep 2026
- Place
- Italy
- Who
- Revolut · Financial Services
- The way in
- Email impersonation
- Source
- Infosecurity Magazine
What was reported.
Threat actors compromised Italian Ministry of the Interior email accounts to send fake European Investigation Orders to Revolut, requesting customer KYC data. Several hundred accounts belonging to high-net-worth crypto users were reportedly impacted by the fraudulent data requests.
The way in the source reports: email made to look like it came from a trusted sender.
To send Revolut the fake requests for KYC information, the threat actors impersonated Italian law enforcement by compromising Italian Ministry of the Interior email accounts using infostealer logs.Infosecurity Magazine, added to these pages on 28 Sep 2026. The source
What forged email is.
Forged email is a message that shows a trusted sender's name or address while someone else sent it. The receiving server decides whether to deliver it. It follows what the real domain publishes about its own mail.
Attackers use it where a message moves money or opens a door: a changed bank detail on an invoice, a request to approve a payment, a link to a page that asks for a password. The message reads as routine because it arrives under a name the reader already trusts.
We read the records a domain publishes for its mail: whether it has a DMARC record, what that record tells receivers to do with a forged message and which services its SPF record names as senders. Those records are public and anyone can check them.
A reading of public records cannot see a message that was sent or received, the rules inside a mailbox or whether a person replied to a forgery. It shows whether the domain tells receivers to refuse mail forged in its name.
This part is true of every case of this kind. It says nothing more about Revolut than the source does.
What we check for it.
Whether anyone can send mail that passes as your domain.
If this happens at your firm.
- Treat an email from a colleague that asks for a payment or a password as unconfirmed until you have spoken to them.
- Tell your clients how your firm confirms bank details, so a forged email that asks otherwise stands out.
- Confirm any request to pay or to change bank details on a number you already hold, never one in the email.
What we read for technology companies.
- The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
- Breach records for addresses at your own domain.
- Names made from yours, each asked whether it is registered and set up for mail.
- The certificate your website answers with: its name, its dates and who issued it.
- The headers and cookies your website sends to every visitor.
- Common addresses for configuration files, code folders and cloud storage.
The rule, from its source: What does each US state's data breach law ask a business to do?
See your own firm the way an attacker reads it.
We read your domain from public records and show each way in with a check anyone can re-run.
Source.
Source: Infosecurity Magazine ↗This page repeats what the source reported, with its date. It says nothing about any firm that is not named in it.