Privacy and power
Attackers claim 147 GB of Revolut data
A forged Italian government order reportedly opened the bank’s customer files, and the compliance rules gave it no good way to tell.
The Revolut breach moved from alarm to anatomy overnight. Lyudmyla Kozlovska says the attackers first took over Italian government and law-enforcement mailboxes, then sent the Lithuanian bank a forged European Investigation Order over five months.
According to Kozlovska’s account, Revolut answered each request because FATF recommendations and European anti-money-laundering rules require it to answer state requests. The rules can punish refusal with fines of up to €5 million or 10 per cent of turnover, while requiring no reliable check that the state behind a request is the state it claims to be.
Every bank, exchange, payment provider and #CASP in every jurisdiction that follows FATF rules is exposed the same way
The attackers say the Italian side of the haul is 147 GB, including internal documents and officer chat logs, and that passports and KYC selfies are being published while they demand payment. The claims are still claims; the exposure described is not a theoretical one.
Kozlovska’s remedy is political: put the safeguards rejected by the European Commission and Council back into the rules, before the next leak names someone who does not have the means to move house.
