Revolut security incident: GDPR lessons, Law Enforcement Request risks, and protection measures
Data security in the financial technology (fintech) sector is evolving rapidly, with cyber attacks becoming increasingly sophisticated. Recent incidents affecting European financial platforms have highlighted a critical vulnerability: how official Law Enforcement Requests (LER) for data access are verified.
In this article, we analyze the technical and legal dimensions of the security incident associated with Revolut, assess its impact under GDPR and NIS2 frameworks, and provide a practical guide for protecting personal data and financial accounts.
What happened: analysis of the security incident
According to available public reports and ongoing investigations, a security incident affected a limited number of European users on the Revolut platform (approximately 680 accounts).
The attack did not involve a direct breach of the digital bank's core infrastructure, nor was there unauthorized access to client funds. Instead, threat actors utilized an advanced social engineering scheme involving a compromised institutional email address belonging to a public authority in Italy (the Prefecture of Reggio Calabria) to submit fraudulent data requests.
Key elements of the incident:
- Attack vector: Requests for information were sent from a legitimate but compromised institutional email account, impersonating an official law enforcement inquiry.
- Targeted data: Certain identification details and financial histories were disclosed following the processing of requests initially assessed as legitimate. Customer funds were unaffected.
- Extortion attempt: Following the incident, a cyber group (iamnotavillain) posted a $3 million ransom demand on the dark web.
- Investigation: Italian authorities (National Antimafia and Counter-Terrorism Directorate), in coordination with the Italian Data Protection Authority (Garante) and Lithuanian authorities (where Revolut holds its European banking license), are conducting formal investigations.
Technical clarification: Temporary service disruptions reported by users in the app represent distinct technical events, absent official confirmation to the contrary. Any direct link between the LER-based attack and temporary app outages remains an unverified hypothesis.
The GDPR framework: controller obligations
This incident highlights the challenges data controllers face when managing official requests from authorities.
"The incident proves that checking an email domain is no longer sufficient. Organizations must validate the physical and legal identity of the requester through secondary channels, rather than relying solely on technical channel authenticity." — GDPR Consulting Team
1. Integrity and confidentiality (Art. 5(1)(f) GDPR)
Personal data must be processed in a manner that ensures appropriate security. Controllers must enforce strict verification procedures before disclosing data to third parties, regardless of whether they claim to be public authorities.
2. Controller responsibility (Art. 24 GDPR)
The controller must implement appropriate technical and organizational measures to ensure and demonstrate that processing complies with the regulation.
3. Data protection by design and by default (Art. 25 GDPR)
Internal workflows (Privacy by Design) must ensure that special data requests pass through multi-layered verification controls.
4. Security of processing (Art. 32 GDPR)
Controllers and processors must implement technical measures (such as encryption and multi-factor authentication) alongside organizational measures (such as staff training and Out-of-Band verification).
5. Breach notification (Arts. 33 & 34 GDPR)
In the event of a personal data breach, the controller must notify the competent supervisory authority within 72 hours and inform affected data subjects if there is a high risk to their rights and freedoms.
Implications of the NIS2 Directive and operational risk management
Under Directive (EU) 2022/2555 (NIS2), cyber resilience requirements have tightened significantly for essential and important entities:
- Incident reporting: Strict timelines for early warnings (24 hours) and formal notifications of significant incidents.
- Supply chain and third-party risk: Rigorous verification of communication channels used by partners and authorities.
- Management accountability: Executive management is directly responsible for approving and overseeing cybersecurity risk management measures.
Lessons for DPOs, CISOs, and executive leadership
To prevent Law Enforcement Request spoofing, organizations must transition from passive checks to active controls.
DPO / CISO Checklist: preventive controls
- ✅ LER procedure overhaul: Establish a centralized registry and single point of contact for law enforcement inquiries.
- ✅ Out-of-Band (OOB) verification: Mandatory phone verification using official public directory numbers before releasing data.
- ✅ Four-Eyes principle: High-risk disclosures must require approval from at least two authorized roles (e.g., Legal + DPO).
- ✅ Mandate assessment: Thorough review of the legal basis and data minimization scope.
- ✅ Anti-social engineering training: Practical simulations for support and compliance staff to detect manipulative requests.
User protection guide: how to secure your bank account
Users can implement several measures to mitigate personal security risks:
- Enable multi-factor authentication (2FA / MFA): Use biometrics or authenticator apps.
- Monitor transaction alerts: Keep real-time push notifications active for all account movements.
- Update passwords and PINs regularly: Avoid reusing credentials across platforms.
- Beware of phishing attempts: Banks will never request your PIN, password, or full card details via email or phone.
- Use single-use virtual cards: Limit exposure when making online purchases on unfamiliar sites.
Legal disclaimer
Note: The information in this article is based on publicly available sources at the time of publication and ongoing investigations. Pending final official findings, certain technical and legal details may be subject to update. This article is provided for educational purposes and does not constitute formal legal or financial advice.
Sources and references
- Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR)
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)
- ANSA Italian News Agency (Agenzia Nazionale Stampa Associata)
- Financial Times - Reports on fintech data security
- SecurityWeek & Euronews - Financial sector cybersecurity analysis
- Italian Data Protection Authority (Garante per la protezione dei dati personali)
GDPR Consulting solutions for your organization
Looking to evaluate your organization's Law Enforcement Request procedures, GDPR workflows, or NIS2 compliance controls? GDPR Consulting provides tailored compliance audits, risk assessments, and executive training.