A Valid Government Mailbox Is Not Proof of a Valid Data Request

The important lesson is not that government domains are inherently unsafe; it is that domain legitimacy and mailbox authenticity do not establish that a request is authorized, current, or genuinely sent by the named official. The attacker claim was that the request was a legitimate government demand.

That claim was false, according to the available reporting and Revolut’s confirmation. The supplied information does not establish how the account was accessed, which agency was involved, how many customers were affected, or whether every listed data type was disclosed in every case.

Organizations handling sensitive records should therefore treat email-based authority as one signal among several. High-impact disclosures need independent confirmation through a known channel, documented legal validation, least-necessary data selection, and escalation when a request is unusual or urgent.

Public-sector cyber defenses face staffing and funding constraints