Italy Probes Revolut-Linked Breach of Government Emails

Italy's national cybersecurity agency, the Agenzia per la Cybersicurezza Nazionale (ACN), is investigating a significant breach involving government email accounts, with preliminary findings suggesting a potential link to a prior data leak involving the financial technology company Revolut. The ACN reported on March 11, 2024, that over 650 cases have been identified where certified government email accounts were either abused or used illicitly. These compromised accounts were reportedly exploited to send phishing emails, a common tactic used to trick recipients into revealing sensitive information or downloading malware.

The investigation is focusing on how these certified email accounts, which are intended for official government communications and carry a higher level of trust and security, were compromised. The ACN's preliminary report indicates that the compromised accounts were used to send "malicious emails" to a broad range of recipients. The agency has not yet definitively confirmed the direct causal link to the Revolut data leak, but the timing and nature of the abuse have prompted a thorough examination of this possibility. The ACN is working in conjunction with other law enforcement agencies to trace the origin of the attacks and identify the perpetrators.

This incident highlights the persistent threat of cyberattacks targeting government infrastructure and the potential cascading effects of data breaches across different sectors. Revolut, a UK-based fintech company known for its digital banking services, experienced a data breach in September 2022, which reportedly affected approximately 50,000 customers. While the full scope and impact of that breach were detailed at the time, the current investigation in Italy suggests that information or credentials potentially exposed during that incident may have been repurposed for subsequent malicious activities targeting Italian government communications. The ACN is urging all public administration entities to remain vigilant and implement enhanced security measures to protect their digital assets.

The investigation aims to understand the full extent of the compromise, identify the vulnerabilities exploited, and prevent future occurrences. The use of certified email accounts for phishing attacks is particularly concerning, as these accounts are often trusted by default, making them effective tools for cybercriminals. The ACN's proactive stance in investigating and reporting these incidents underscores the growing importance of cybersecurity in safeguarding public services and sensitive government data. Further updates are expected as the investigation progresses and more concrete evidence emerges regarding the connection between the Revolut data leak and the compromised Italian government email accounts.