{"id":1817,"date":"2026-09-21T14:52:18","date_gmt":"2026-09-21T09:22:18","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1817"},"modified":"2026-09-22T15:37:09","modified_gmt":"2026-09-22T10:07:09","slug":"revolut-infostealer-fake-government-request-breach","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/revolut-infostealer-fake-government-request-breach\/","title":{"rendered":"Revolut Data Breach: Infostealer Credentials and Fake Government Requests"},"content":{"rendered":"

Introduction<\/h2>\n

An email from an official address can still contain a fraudulent request. The Revolut data breach, disclosed in September 2026, illustrates that risk. Attackers used a legitimate government email channel to impersonate authorities and obtain customer information.<\/p>\n

Infostealers can harvest credentials from unmanaged or personal devices, enabling attackers to take over authentic accounts, including government email accounts using Italy\u2019s certified email system, PEC. This explains a potential route to account takeover, rather than a confirmed entry point in this incident.<\/p>\n

Revolut acknowledged the impersonation scam and contacted affected customers. The case highlights a practical identity security problem: a trusted sender address does not establish that someone has authority to receive sensitive records.
\n \t\t

\r\n \t\t\tWho is IAmNotAVillain?<\/span> \t\t\t \t\t\t\t

\r\n \t\t\t\t\tIAmNotAVillain is the online name associated with public claims of responsibility and an extortion demand linked to this incident. Public reporting does not establish whether the name represents one person or several people. Their identities, location, and broader operational history remain unverified.<\/p>\n

The actor claimed to have selected customers with substantial cryptocurrency holdings and obtained their information by impersonating Italian law enforcement. However, those claims do not establish a verified history of targeting financial institutions or cryptocurrency users.<\/p>\n

Security teams should therefore treat the name as an incident-linked alias. The relevant behavior is the alleged combination of government account compromise, fraudulent information requests, and threats to publish customer data. \t\t\t\t<\/p>\r\n \t\t\t \t\t\t\r\n \t\t<\/div>\r\n \t\t<\/p>\n

What happened?<\/h2>\n

The reported attack involved government email account takeover followed by abuse of a customer-data disclosure workflow. Public evidence does not establish a direct intrusion into Revolut\u2019s internal systems.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
Area<\/th>\nWhat is known<\/th>\n<\/tr>\n<\/thead>\n
Root Cause\/Initial Access<\/td>\nGovernment account takeover via infostealer malware stolen credentials; no direct intrusion into Revolut systems.<\/td>\n<\/tr>\n
Disclosure and duration<\/td>\nThe incident became public in September 2026. Accounts describe activity lasting several months, but the exact start date and duration remain uncertain.<\/td>\n<\/tr>\n
Affected organization<\/td>\nFraudulent requests reportedly targeted Revolut Bank UAB, its Lithuania-based banking entity.<\/td>\n<\/tr>\n
Customer impact<\/td>\nApproximately 680 customers reportedly had personal and financial information exposed.<\/td>\n<\/tr>\n
Communication channel<\/td>\nThe requests used an Italian government email account associated with the country\u2019s certified email system, PEC.<\/td>\n<\/tr>\n
Data involved<\/td>\nReported exposure included identity documents, contact details, addresses, and financial records. The information disclosed may differ between customers.<\/td>\n<\/tr>\n
Extortion<\/td>\nAn actor publicly demanded $3 million. Revolut said it had received no direct contact or demand from those making the claims.<\/td>\n<\/tr>\n
Confirmed response<\/td>\nRevolut said it blocked the address, notified relevant authorities, and contacted affected customers. It stated that its systems and customer funds remained unaffected.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

These distinctions separate the acknowledged disclosure from claims about targeting, campaign length, and extortion.
\n

\n
\n
\n
\n \"The-role-of-UEM-in-cyber-security\"\n <\/div>\n <\/div>\n
\n
\n Feature Resource \n <\/h5>\n

\n The role of UEM in cyber security\n <\/h4>\n

\n Learn how Unified Endpoint Management helps companies enhance cyber security.\n <\/p>\n \n Get the Infographic\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section><\/p>\n

How infostealer credentials may have enabled access<\/h3>\n

Research linked the government account compromise to infostealer malware, which can collect stored login information. However, the infection\u2019s origin remains uncertain. The attackers may have acquired existing stolen credential records rather than directly infecting the government employee.<\/p>\n

The reported account-control techniques included adding an attacker-controlled recovery email and deleting messages to conceal activity. These details derive from an attacker-linked account of the campaign, rather than a public forensic report. No verified evidence establishes an MFA bypass or identifies the malware family.<\/p>\n

How fake government requests created the disclosure risk<\/h3>\n

The attackers allegedly used access to an official mailbox to make requests appear authoritative. That distinction matters: authenticating an email\u2019s origin does not validate the sender\u2019s purpose or legal authority.<\/p>\n

The available reporting describes data disclosure and extortion. It does not establish ransomware encryption or theft of customer funds.<\/p>\n

Why this matters<\/h2>\n

A financial data breach can begin outside the organization that holds the records. If attackers control a trusted external account, staff may receive convincing requests through familiar channels.<\/p>\n

This creates two separate security requirements. Organizations must protect accounts and devices against credential compromise. They must also verify why someone is requesting information and whether the requested disclosure is authorized.<\/p>\n

For IT and security teams, the implication is practical: endpoint controls should support a documented approval process. A healthy employee laptop cannot make a fraudulent external request legitimate.<\/p>\n

Likewise, protecting the request-handling team\u2019s devices does not secure a government agency\u2019s mailbox. Organizations need independent verification, limited data disclosure, and reviewable approval records alongside technical safeguards.
\n

<\/div>

What is Digital Employee Experience (DEX)? \u2013 A Complete Guide<\/h4>

Learn how digital employee experience (DEX) helps IT reduce friction and improve everyday work.\r\n<\/p><\/div><\/div><\/div><\/a><\/div><\/div><\/div><\/p>\n

How Hexnode can help<\/h2>\n

Hexnode can help reduce opportunities for credential theft by hardening corporate endpoints, enforcing device-aware access, and supporting rapid threat containment.<\/p>\n

Hexnode UEM: Reduce infostealer risk before credentials are exposed<\/h3>\n

Hexnode UEM<\/a> helps administrators control which applications can run on corporate endpoints. On supported Windows devices, application allowlisting can restrict execution to approved software, helping block unauthorized applications that could carry infostealers. Administrators can also automate supported OS and application updates to close vulnerabilities that malware could exploit.<\/p>\n

Through supported Microsoft Entra ID and Okta integrations, administrators can restrict access to protected applications to compliant devices. Compliance requirements can include minimum OS versions, encryption, and application restrictions. The identity provider uses Hexnode\u2019s compliance signals to enforce the configured access policies.<\/p>\n

Together, these controls reduce opportunities for malware execution and help keep devices that fail security requirements away from sensitive workflows.<\/p>\n

Hexnode XDR: Detect suspicious activity and respond quickly<\/h3>\n

Hexnode XDR<\/a> provides threat detection and investigation across Windows and macOS endpoints. Contextualized alerts and endpoint threat hunting help security teams investigate suspicious activity and identify affected devices.<\/p>\n

For suspected credential theft, investigation priorities include LSASS memory dumping on Windows and unauthorized access to browser credential or session files. Teams should confirm coverage for these behaviors against their available telemetry and configured detection rules.<\/p>\n

Responders can then take one-click actions to kill malicious processes, quarantine files, and isolate affected endpoints. These actions help interrupt malicious activity and contain an infection while the team investigates.<\/p>\n

Pair endpoint containment with credential resets, session revocation, and mailbox activity reviews when account compromise is suspected. For sensitive disclosures, retain independent checks of the requester\u2019s authority and the request\u2019s legal basis.<\/p>\n

What security teams should do next<\/h2>\n

The Revolut data breach highlights a gap between trusting a communication channel and authorizing a disclosure. Review the complete request-handling process, including who receives requests, who validates them, and who releases records.<\/p>\n

Start by independently confirming the requester through an established contact channel. Require documented approval for sensitive disclosures and release only the information authorized for the request. Preserve requests, verification evidence, and response records.<\/p>\n

Next, strengthen accounts used for official correspondence. Deploy phishing-resistant MFA where supported and review recovery settings and account permissions.
\nIf compromise is suspected, coordinate credential resets, session revocation, mailbox review, and endpoint investigation. Hexnode UEM can support device compliance around protected workflows, while Hexnode XDR can support endpoint investigation and containment.<\/p>\n

Assign clear ownership across security, legal, and privacy teams. Test the process with a simulated fraudulent request, and fix any step that treats an official email address as sufficient authorization.
\n

<\/div><\/div>
Try\u202fHexnode\u202fFree for 14 Days\u202f\u202f\u202f\u202f\u202f<\/h5>

Sign up for Hexnode to strengthen device compliance and reduce endpoint risks.<\/p>