Source: Hudson Rock / InfoStealers, 15 September 2026

Source: Revolut statement via Fintech Business Weekly, 20 September 2026

Assessed from American Banker, 18 September 2026

Assessed from Revolut’s own account of fulfilment; Revolut statement via Fintech Business Weekly, 20 September 2026

Assessed from SecurityWeek, 17 September 2026

Source: CyberInsider, 16 September 2026. [UNRESOLVED] — attacker-side tradecraft not confirmed by Italian authorities.

Source: Hudson Rock / InfoStealers, 15 September 2026; CyberInsider, 16 September 2026. [UNRESOLVED] — attacker-claimed and not confirmed by Revolut.

DORA Art. 5(2) — management-body responsibility for the ICT risk framework; ISO/IEC 27001:2022 Annex A 5.7 — threat intelligence

Enumerate every domain entitled to compel disclosure from you — pec.interno.it and the equivalent PEC, gov and judicial domains in each jurisdiction where you hold a licence — and register them as monitored assets in an infostealer-log feed (Hudson Rock, SpyCloud, Flare class). Alert on any new log referencing those domains. On a hit, automatically downgrade that domain from single-channel trust to mandatory dual-channel confirmation until the issuing authority confirms remediation. This is the only control in this list that would have fired before the first fraudulent request was answered.

DORA Art. 5(1)–(2) and Art. 9(2); GDPR Art. 5(2) — accountability; ISO/IEC 27001:2022 Annex A 5.31 — legal, statutory, regulatory and contractual requirements

Written procedure: the request is re-confirmed by telephone to a number obtained independently from the authority’s published official directory — never a number, address, reply-to or link contained in the request itself. Record the call reference, the name and protocol or badge number of the confirming officer, and the issuing prosecutor’s office, against the case record. The request remains unfulfilled until that confirmation is logged. The exemption clause is the whole failure here: PEC, eIDAS-qualified delivery and a .gov.it domain are exactly the signals that make people skip the call.

Directive 2014/41/EU Art. 2(c), Art. 5 and Annex A, Art. 6(1)(a); Regulation (EU) 2023/1543 (e-Evidence) Art. 4 and Art. 9; ISO/IEC 27001:2022 Annex A 5.31

Require that every EIO arrives on the Annex A form of Directive 2014/41/EU, complete through Sections A to I; that Section H names an issuing authority competent under Art. 2(c); that, where the issuer is not a judge, court or public prosecutor, the order carries judicial validation under Art. 2(c)(ii); and that the proportionality and necessity conditions of Art. 6(1)(a) are stated rather than assumed. Auto-reject and escalate anything arriving as free-text email or as a PDF without the Annex A structure, and never accept a “corrected” resubmission of a rejected instrument. Under the e-Evidence Regulation, require the EPOC or EPOC-PR certificate and route orders to your designated establishment or legal representative under Art. 4 rather than to a support mailbox; Art. 9 gives you an explicit statutory route to seek clarification on a manifestly deficient order.

DORA Art. 9(2) and Art. 10(1) — protection, prevention and detection; NIS2 Art. 21(2)(b) — incident handling; NIST SP 800-53 Rev. 5 AU-6(1) and SI-4(2)

Route all compelled-disclosure requests through a dedicated case-managed queue rather than a shared mailbox, and emit one structured audit event per request carrying requesting domain, instrument type, issuing authority, customer identifiers disclosed, data categories released and named approver. Build three detections on that stream: more than N requests from a single domain in a rolling 30 days; repeated requests naming customers above a defined balance or AUM percentile; and requests arriving outside the issuing authority’s normal working hours or deviating from its established language and formatting pattern. Review the queue weekly at DPO and financial-crime level. A five-month campaign concentrated on high-value accounts is a detection problem long before it is a verification problem.

NIS2 Art. 21(2)(g) — cyber hygiene and training; DORA Art. 13(6) — ICT security awareness and training; ISO/IEC 27001:2022 Annex A 5.3 — segregation of duties, Annex A 6.3 — awareness, education and training

No customer-support tier may fulfil, acknowledge the substance of, or advise on a compelled-disclosure request. Hard-route a keyword set — European Investigation Order, ordine europeo d’indagine, EPOC, EPOC-PR, production order, letter rogatory, and the national equivalents in every licensed jurisdiction — to a named legal or financial-crime function, with two-person approval mandatory above a defined customer-count threshold. Train that function twice yearly on forged-instrument recognition using live red-team submissions rather than slideware. Deliver the user-facing rules in 5B below as a standing briefing to every team that touches inbound requests.

Audience: everyone who touches an inbound request. Forward this page as-is.

NIS2 Art. 21(2)(g) — basic cyber hygiene practices and cybersecurity training; ISO/IEC 27001:2022 Annex A 6.3 — information security awareness, education and training

Maps to ↳ CF-5

1.  A message from a government address is not proof it came from the government.

An email can arrive from a genuine ministry domain simply because someone stole a real employee’s password. The address tells you which mailbox the message left from. It tells you nothing about who was sitting at the keyboard.

2.  Never act on a legal request until you have called the authority back on a number you looked up yourself.

Find the number on the authority’s own official website or published directory. Do not use any phone number, email address or link that appears inside the request — if the request is forged, so is the contact detail printed on it. A five-minute call is the entire control.

3.  If the paperwork is wrong, that is a warning sign — not a customer-service problem.

Do not explain how to fix a malformed legal document, and do not accept a corrected version once you have rejected one. Stop, write down what you saw, and hand it to the legal team. Real authorities have their own lawyers and do not need your help with their forms.

4.  Pass every request for customer data to the named legal team, whatever it looks like.

You are not the approver, and nothing about how official a request looks changes that. Forwarding it costs you a few minutes. Approving a forged one costs a customer their passport, their selfie and their entire transaction history.

5.  Speak up if the same requester keeps coming back.

One request looks routine. Twenty requests from the same office, all about wealthy customers, is a pattern — and you may be the only person in the building positioned to notice it. Say so, even if you are not sure.

6.  Urgency is the oldest pressure tactic there is.

“Emergency”, “immediate” and “active criminal investigation” are chosen to make you skip the verification step. A genuine authority that has waited weeks for a court to issue an order can wait five more minutes for your callback.

Art. 5 (governance and ICT risk framework); Art. 9(2) and 9(4) (protection and prevention); Art. 10(1) (detection); Art. 17 (ICT-related incident management process); Art. 19 (reporting of major ICT-related incidents)

Revolut Bank UAB is a credit institution licensed in Lithuania and therefore a financial entity in scope of DORA, which has applied since 17 January 2025. DORA is cited here because a licensed financial entity is squarely in scope — not as a default framework. Art. 17 requires a documented process for detecting, managing and notifying ICT-related incidents; a five-month undetected disclosure campaign is a direct challenge to it. [UNRESOLVED] Whether the incident crosses the Art. 19 major-incident thresholds on data losses and clients affected is not publicly determinable from the available reporting.

Art. 5(1)(f) (integrity and confidentiality) and 5(2) (accountability); Art. 6(1)(c) read with Art. 23 (legal obligation as lawful basis); Art. 32(1)(b) and (d); Art. 33 (72-hour notification); Art. 34 (communication to data subjects)

This is the sharpest regulatory point in the case. A disclosure made under a forged instrument has no Art. 6(1)(c) legal obligation behind it — the lawful basis collapses entirely, leaving unlawful processing rather than a breach caused by an intruder. Art. 5(2) then requires Revolut to demonstrate the verification it actually performed. [UNRESOLVED] Whether the facial verification selfies were processed as biometric data within Art. 9(1) — which would raise the threshold further — is not determinable from public reporting.

Art. 2(c) (issuing authority); Art. 5 and Annex A (form and required content); Art. 6(1)(a) (necessity and proportionality conditions); Art. 9 (recognition and execution); Art. 11 (grounds for non-recognition or non-execution)

The instrument the attacker forged. It is not a free-form request: it prescribes a standard form, a competent issuing authority and, for non-judicial issuers, mandatory judicial validation — each of which is a checkable control that was available and was not exercised. Art. 11 gives an executing party explicit grounds to refuse. [KB UPDATE NEEDED] Directive 2014/41/EU — European Investigation Order in criminal matters; EU cross-border evidence-gathering instrument between participating Member States; directly relevant to any regulated entity that receives compelled-disclosure requests from EU judicial authorities.

Art. 4 (addressees, designated establishments and legal representatives); Art. 9 (execution of an EPOC and the addressee’s route to seek clarification); Art. 16 (review procedure in case of conflicting obligations)

The successor regime for cross-border production orders, applying from 18 August 2026. It requires service providers to designate an establishment or legal representative to receive orders — which structurally removes the shared-mailbox failure mode seen here — and gives the addressee an explicit statutory route to seek clarification on a manifestly incomplete or erroneous order rather than simply complying. Every institution receiving EU compelled-disclosure requests should be re-papering its intake process against this regulation now. [KB UPDATE NEEDED] Regulation (EU) 2023/1543 — European Production and Preservation Orders for electronic evidence in criminal proceedings; binds service providers offering services in the EU; the governing instrument for compelled-disclosure intake design.

Art. 21(2)(b) (incident handling); Art. 21(2)(g) (cyber hygiene and training); Art. 21(2)(i) (multi-factor authentication and secured communications); Art. 23 (reporting obligations); Art. 20 (management-body accountability)

Engaged on the Italian side, not Revolut’s. The compromised mailbox sits inside a public-administration entity, and Art. 21(2)(i) — multi-factor authentication on communications systems — is the control whose absence made a commodity infostealer log sufficient for mailbox takeover. INTERSECTION FLAG: NIS2 Art. 4 makes DORA lex specialis for financial entities, so NIS2 incident reporting does not double-apply to Revolut itself. Two Member States and two supervisory stacks are engaged at once — Lithuania (Bank of Lithuania for DORA, the State Data Protection Inspectorate for GDPR) and Italy (ACN for NIS2, the Garante for the ministry’s own data-protection duties).

Annex A 5.3 (segregation of duties); A 5.7 (threat intelligence); A 5.31 (legal, statutory, regulatory and contractual requirements); A 5.34 (privacy and protection of PII); A 6.3 (awareness, education and training); A 8.16 (monitoring activities)

The five control failures map one-to-one onto certifiable Annex A controls. A 5.31 is the underused one: it requires an organisation to identify and document how it meets legal requirements — which necessarily includes how it verifies that a claimed legal requirement is real. A 5.7 covers the infostealer-feed monitoring that would have caught the exposed credential before it was used.

AU-6(1) (automated process integration for audit review); SI-4(2) (automated tools for real-time analysis); IA-5 (authenticator management); AC-5 (separation of duties)

Provides the control-level vocabulary for instrumenting the legal-request path — the audit-review automation and real-time analysis that a five-month campaign should have tripped. Useful where a client’s control framework is NIST-aligned rather than ISO-certified.

SEG extends the third-party register beyond suppliers to counterparties that can compel you — regulators, judicial authorities, law-enforcement agencies — and stands up continuous infostealer-log monitoring against their domains, so an exposed credential at an authority becomes an alert on your side rather than a request you answer.

SEG writes and embeds the compelled-disclosure procedure: mandatory out-of-band callback, independently sourced contact channels, two-person approval thresholds, Annex A form validation, and the DORA Art. 17 incident-management linkage — then evidences it for your supervisory authority.

SEG reviews the case-management, ticketing and shared-mailbox tooling that legal requests actually arrive in, closing the logging, retention and access gaps that leave a privileged disclosure path with no usable audit trail.

SEG red-teams the disclosure channel directly — submitting realistic forged instruments from lookalike and, where authorised, genuine-appearing certified channels — to establish empirically whether your verification step holds under pressure, rather than assuming it does because it is written down.

SEG delivers the 5B rules above as targeted training for customer-facing, operations, legal and financial-crime teams, built around forged-instrument recognition, escalation discipline, and resistance to manufactured urgency from apparently official sources.

The industry has spent a decade hardening the front door and almost no time on the channels it is legally obliged to leave open. Compelled disclosure — European Investigation Orders, e-Evidence production orders, emergency data requests — is a high-privilege, low-friction data path that most regulated institutions run on institutional courtesy and a recognisable domain name. The lesson of this case is that the credential setting your exposure may belong to a government you cannot audit, bought for a few dollars in a log that was already on the market. Expect this technique to generalise quickly beyond fintech: the same channel exists at every telecommunications operator, cloud provider and exchange in Europe, and it is answered by people trained to be helpful.

We want boards to sit with the most uncomfortable sentence in this case: Revolut did what the law told it to do. There was no unpatched system, no phishing click, no missed alert — the bank received what appeared to be a lawful order from a government mailbox and honoured it, for five months. That should reframe how risk committees think about their own exposure, because every institution we work with has a channel like this one, and almost none of them have ever tested it. Our second point is about ownership. The credential that opened this was not Revolut’s, was not its supplier’s, and sits in no third-party risk register we have ever reviewed — it belonged to a public authority with the legal right to compel disclosure and no contractual obligation to you whatsoever. You cannot audit that authority, you cannot demand its MFA posture, and you cannot make it rotate a password. What you can do is stop treating its domain as identity, monitor it against infostealer feeds, and require a callback on a number you looked up yourself before any customer data leaves the building. DORA makes the governance obligation explicit and places it with the management body, not with the SOC. The right question for the next board meeting is not whether you would have detected this — it is who in your organisation is currently allowed to answer a government request, and what, precisely, they are required to check before they do.