The Revolut case: now the Trojan horse is travelling via the government’s PEC system

To hack a European bank in 2026, all you need is a PEC address ending in ‘gov.it’. A group of hackers obtained a genuine one and used it to request data on certain customers from Revolut. The bank verified the sender and sent documents, photographs, accounts and cryptocurrencies. Around 680 customers, according to the Financial Times. No intrusion, no euros stolen: a request fulfilled with due diligence. The anti-forgery checks had worked for the most embarrassing of reasons: there was nothing to forge. The message was genuine. The certified email certified the delivery of a theft.

It is important to distinguish between what has been established and what is merely claimed. It has been confirmed that the data was obtained, upon request, from a genuine public domain. The attacker, ‘IAmNotAVillain’, claims to have had access for six months to systems linked to the Italian police and to be in possession of 147 gigabytes of material. Nevertheless, the fact remains: a public authority was able to order a financial intermediary to hand over its customers’ identity files, and the intermediary complied because the law requires it to do so.

This is where the economic and institutional crux lies. For a regulated entity, cooperation with the authorities is not a choice: it is an obligation. The attacker did not circumvent that obligation; they capitalised on it. The more the duty to cooperate swiftly is reinforced, the greater the attack surface becomes. Compliance ceases to be a shield and becomes a risk multiplier. Every operator discovers they have a single point of failure outside their own perimeter: the credibility of the public request.

There is a second asymmetry. The dossier was not compiled on a commercial basis, but because the regulator requires it. Documents, asset statements, transactions: KYC builds the most valuable identity file for a bank. But the party imposing the collection requirement cannot bear the risk of data leakage. The cost falls on the intermediary, as does civil liability, whilst the damage falls on the citizen, who has already received the first extortionate demands. The authority that imposed the data collection – and whose own system would have been the vector for the breach – thus generates a negative externality: it offloads the consequences of its own vulnerability onto the entity under its supervision.

The asymmetry of liability leads to an asymmetry of investment. Revolut risks investigations, sanctions and reputational damage: it will invest in verification because it is in its interests to do so. The public body whose digital identity has been impersonated faces no risk: it will continue to invest very little. As long as the state’s digital credentials serve as a free pass without the state being held accountable for how it safeguards them, impersonation will remain one of the cheapest options on the criminal market. The irony is that, with its AI law, Italy is introducing a ‘danger offence’ for those who fail to implement security measures in advanced IT systems. A strict rule for the plant manager of an SME, but one that remains silent on the authority from whose certified email account (PEC) hacked messages may be sent. This ‘pan-penalism’ in the tech sector punishes downstream companies whilst absolving upstream authorities.

The remedies are tedious and inexpensive. Mandatory out-of-band verification for every request for identity data: the office must be contacted via an official contact point before attaching documents. A personal cryptographic signature for the official, with revocable keys, because the email account certifies the office but not the person pressing ‘send’. Monitoring of anomalies in outgoing data volumes. The intermediary’s right to suspend and verify without penalties for delay: the law rewards those who respond quickly, not those who respond correctly. And a basic symmetry of responsibility: if the public channel is the carrier, part of the cost falls to the channel owner. Finally, transparency: publish the number of data requests each authority sends.

In Homer’s tale, the Trojans at least had to drag the horse into the city. Here, not even that was necessary. The city walls sent the key via certified email, with a delivery receipt and legal validity. And the citizens will discover that their data has not merely been stolen: it has been escorted out, using the badges affixed to the very devices that were supposed to protect them.