Revolut Hit by Alleged Hackers With Italian Police Data—And Spain Warns of AI Data Theft

On 2026-09-16, hackers claimed an attack on Revolut tied to Italy’s anti-mafia and counter-terror apparatus, alleging they obtained Italian police data. The report, attributed to ANSA, frames the incident as an operational strike against a British bank by an “anti-mafia” and “terror unit” acting in the context of the breach claim. Separately, Spain’s data protection authorities were notified of what is described as the first alleged AI-powered data theft attack, according to BleepingComputer. The Spanish Data Protection Agency (AEPD) said the incident involved an AI agent powered by a known large language model (LLM), shifting the threat narrative from traditional intrusion to AI-assisted extraction. Geopolitically, the cluster points to a widening intelligence-and-finance nexus where law-enforcement datasets become both a target and a bargaining chip. If the Revolut claim is credible, it suggests adversaries can bridge national policing ecosystems and cross-border financial platforms, raising the stakes for European data sovereignty and counter-terror cooperation. The Spain case underscores that AI agents can be operationalized quickly, potentially outpacing governance frameworks and creating asymmetry between regulators and attackers. Meanwhile, a Handelsblatt conference report adds a regulatory dimension: Germany’s BaFin is signaling that insurers need to improve how they use data in AI systems, implying that compliance gaps may be exploited or at least become a reputational and supervisory risk. Market implications are concentrated in financial services and data-intensive insurance underwriting. For fintech, a Revolut-linked incident can pressure sentiment around digital banking risk controls, with potential knock-on effects for payment processing, identity verification, and fraud-detection vendors. For insurers, BaFin’s focus on data usage in AI systems raises the probability of tighter supervisory scrutiny, which can translate into higher compliance costs and slower deployment of AI-driven pricing or claims automation. In the near term, the most visible market signals are likely to be volatility in cybersecurity and regtech equities, widening spreads for cyber insurance, and increased demand for data governance tooling across EU jurisdictions. What to watch next is whether authorities validate the Revolut data claim, identify the specific datasets allegedly accessed, and determine whether any personal data or credentials were exfiltrated. For Spain, the key trigger is whether the AEPD confirms the AI agent’s role as an autonomous extractor and whether it maps to known LLM capabilities or bespoke prompting workflows. In Germany, BaFin’s supervisory expectations for insurers will matter for timelines: look for follow-up guidance, enforcement actions, or required remediation plans tied to AI data governance. Escalation would be indicated by additional cross-border claims involving law-enforcement data, while de-escalation would come from rapid containment, clear attribution, and coordinated regulator disclosures.

Geopolitical Implications

• 01

  Cross-border targeting of financial platforms using law-enforcement datasets could strain EU data sovereignty and counter-terror cooperation.

• 02

  AI-assisted intrusion lowers the attacker’s operational barrier, potentially outpacing national regulators’ incident-response and governance capacity.

• 03

  Regulatory convergence (AEPD/BaFin) may accelerate EU-wide enforcement on AI data handling, affecting how financial institutions deploy AI.

Key Signals

• —Whether Italian and UK authorities validate the Revolut claim and specify which police datasets were allegedly accessed.
• —AEPD findings on the AI agent’s autonomy, the LLM used, and whether the attack involved exfiltration of personal data or credentials.
• —BaFin follow-up guidance or enforcement actions for insurers’ AI data governance, including timelines for remediation.
• —Additional public claims by threat actors referencing other national law-enforcement databases.