Italy probes government email breach tied to Revolut leak

Polizia Postale has opened a probe for alleged unauthorized access to a government email account after the inbox was reportedly used to request and obtain customer data from fintech firm Revolut. Authorities are investigating potential computer intrusion and computer fraud.

Initial accounts linked the compromised address to the Prefecture of Reggio Calabria; the prefecture denied sending any requests to Revolut. Revolut declined to identify which government agency’s email was compromised, citing an active police investigation and confidentiality obligations.

Revolut reported the incident to Italian authorities when it detected the activity and offered to assist investigators. The company said its internal systems, customer databases and customer funds remained secure.

The compromised address was reportedly part of Italy’s Posta Elettronica Certificata (PEC), a certified email system that gives messages legal standing similar to registered mail. Italy’s CERT-AGID cybersecurity authority has warned that PEC certifies delivery but does not guarantee the confidentiality of message content.

CERT-AGID reported handling more than 650 cases involving abused or illicit PEC accounts since early 2026. Security specialists have warned that attackers can exploit compromised PEC accounts to request data or trigger processes that rely on the legal weight of PEC communications.

Investigators are working to determine how the government email was accessed and whether the account was used only to request information or to bypass other security checks. Law enforcement is tracing the origin of the disclosed data.

A group claiming responsibility for the incident has threatened staged releases of customer information. Revolut has not disclosed the scope of the leaked dataset or how many customers may be affected, citing the ongoing investigation.

Italian authorities and Revolut continue to coordinate on the inquiry. Officials are reviewing procedures for using certified email in official records requests and the security controls around those processes.