Italy: Operational Resilience & Critical Infrastructure

Operational Resilience & Critical Infrastructure

Revolut disclosed a confirmed data breach around 12 September 2026 that exploited the European Investigation Order mechanism under the EU e-Evidence Regulation, a mechanism that became operative on 18 August 2026, via a spoofed institutional PEC mailbox. Funds and core systems were not affected; the breach was limited to customer personal data. Because Revolut serves Italian customers without being an Italian-chartered institution, the incident's resilience implications extended beyond the firm itself into a sector-wide Italian regulatory response.

The Garante per la protezione dei dati personali opened an immediate review of Italian banks' access-security controls between 16 and 18 September 2026, writing directly to bank data protection officers to request checks for anomalous communications originating from the compromised PEC address used in the Revolut incident. This review represents a direct engagement with bank access-security controls prompted by a non-bank payment-service-provider incident, illustrating how an operational-resilience event at one type of payments entity can generate supervisory attention toward a different, interconnected part of the payments ecosystem. The review produced a further public update on 30 September 2026 and remained open as of that date, with no published outcome identified.

Cross-border supervisory coordination followed directly from the incident: the Garante contacted Lithuania's data protection authority, which holds lead-supervisory-authority status for Revolut, to exchange information, and separately approached Italy's Ministry of Interior to establish whether other financial institutions in Italy had been targeted by the same spoofed-PEC technique. This coordination reach, spanning both a cross-border regulatory counterpart and a domestic security-focused ministry, indicates the review's scope extends beyond a single-institution incident response toward an assessment of whether the underlying technique poses a broader sector risk.

Outlook

The principal item to watch is the outcome of the Garante's bank-security review, not yet published as of this cycle. A finding that other Italian financial institutions were targeted using the same spoofed-PEC technique would extend the operational-resilience implications from a single-firm incident to a sector-wide access-security question, with potential bearing on resilience expectations for Italian banks and payment service providers more broadly.