OK, I’m a bit surprised they gave them data about non-Italians and non-Italian residents, what the news implies. Last time I’ve read about the financial data sharing directive I was pretty sure the entities/countries have to scrutinize the legitimate need-to-know, for example if Italy asks for financial data of a German tax resident the Germany should show them the finger as it’s Germany responsibility to tax the person.
Anyway, I wonder if Revolut informed all affected customers about the breach or they now tell the customers “data protection”
Usually likedin is full of…but, Mr. Freeman was there and did it. It was some years ago, and gave back the stolen money. He was quoted by the WSJ as security expert with knowledge of this event. His understanding of what happened:
The target was Revolut Bank UAB (Lithuania). So, no need to defame outsourcing to India.
The method was forged docs, either court orders or European Investigation Orders (EIO). The European Union Agency for Criminal Justice and Cooperation (EUROJUST) has a nice website explaining what an EIO is.
Relevant authority in issuing country drafts an EIO.
EIO is sent to counterpart authority in executing country
The relevant authority in executing country reviews the EIO and decides if acting on the request or not.
Local authority in executing country ask the info to individuals or organisations (e.g. banks)
The issue here is that EIOs are never sent to individuals or banks. EIOs are sent to local judge and then local judge sends a data request to a bank.
So, what happened? Full speculation because no published details, A or B?
A) Hackers sent an EIO to local authority in Lithuania from hacked official communication channel in Italy. Then, local authority in Lithuania accepted the requested, asked for info to Revolut and forwarded it to hackers.
B) Revolut answered to multiples EIOs from authorities in a foreign state without ever receiving a request from local authorities. It seems they got phished into believing the Lithuanian authorities approved the request.
Option A would be extremely embarrassing for relevant authority in Lithuania. Their one job is to asses if the EIOs they receive are legit or not.
Option B would be extremely embarrassing for the compliance department of Revolut. The EUROJUST framework tells they should answer to local authorities, never to foreign ones. The ignorant public assumes the compliance department of a bank should be familiar with the legal framework of the country where they operate.
Waiting for updates, this beats any TV drama in entertainment terms.
Corriere : Was Revolut right to respond to requests originating from a certified email (PEC) address linked to the Prefecture of Reggio Calabria?
Cristian Palusci: a former army officer and Bitcoin expert—attempts to clarify this matter in a lengthy post on X, stating: “There is a grotesque aspect (…) of a legal-procedural nature. The Italian institution’s certified email address from which the request to Revolut originated is responsible for coordinating public order, yet it lacks the criminal jurisdiction to issue orders for the acquisition of banking data held abroad (a power that belongs to Public Prosecutor’s Offices via dedicated judicial channels). In this regard, ‘Revolut’s legal team therefore accepted a bogus European Investigation Order (EIO) formally sent by an administrative office that should never have issued it.’”
Allegedly, the Prefecture of Reggio Calabria is only a low level office which does not have the competence to fill up and send European Investigation Orders. The unauthorized access and use of this email account is irrelevant. The event can be described as the municipal Einwohneramt sending me a speeding ticket. Yes, they are the government, but do they have the competence to send a speeding ticket? So, even if the legitimate user of the email account have sent the request for customer data, the answer from Revolut should have been:
Dear officer,
We regret to inform you that your office has not the mandate and capability to make an EIO about customer data. Please refer to your local judiciary system and find a damned judge with the competence relevant for this request. We look forward to receiving a mandate from our local judiciary.
Ciao ciao.
Revolut chose a bold strategy: blame the Italians and tell that they were only good boys. Time will tell if it works (people forgets about it) or if the backlash comes twice as strong once the information about the irrelevance of the hack is free.
As a tiny ant in Switzerland I can only smile and give the highest praise to Swiss banks. A true Swiss bank goes the extra mile to protect the identity of a customer. How far? To the point of getting convicted for conspiring to hide assets and pay millions in fines, that far. Compare that to millenials that fold at the first sight of a stressful situation, thus avoid and comply like good boys…kids these days
Even ignoring this, digital signatures have been around for a while. You’d think that everything would have been secured with a digital signature which could them automatically reject request without signature or from an entity which doesn’t have authority to make the request.
Dear Sirs
I am Darkh Fatger from the republic ov real universchaläi.
I ask for detailed Rfuicks of XSSS from gohowdl.
If you don’t comply you will end on our mafia list!
Sorry, first of all you don’t deny or admit any client connection as a Swiss institution without a judges order. You need a few years more just to learn that. If you still want to charge Swiss fees you need to bring something more to the table.
First rule of Swiss banking is to be discrete. Why else would somebody pay that insane fees?
Go home to wherever you came from (GB?) and don’t try to play with the big boys. A few of those XX YY ZZ posts wont do it!
In 2025, Switzerland sent information on 3,813,212 financial accounts to partner countries. 10.35% of those were sent to Italy, which works out to about 394,700 accounts under automatic exchange of bank/financial-account information for tax purposes (AEOI/CRS).
This is different, it is the automatic exchange of account info. The Swiss send this to other countries automatically, without them asking, hence the large number. The other country can chose how to use the info.
This relates to people living in the respective countries (ie 394k accounts sent to Italy: basically those accounts have an Italian home address; BTW it includes company accounts too).
Swiss residents with a Swiss bank account do not fall in that category.
So you can say : “…discrete, as long as you live in Switzerland..”
