# They are selling the dossiers

2026-09-25

After the prefecture-mailbox requests, the people who hold the Revolut files say they are selling them and billing the customers to be removed. Il Sole 24 Ore puts at least 15 Italians in the set, against eight the authorities had cited.

Canonical: https://www.fabiocti.com/notes/they-are-selling-the-dossiers/
Author: Fabio Correia

The earlier note was how the files left: a real Italian government mailbox, about 680 dossiers, no breach of the banking core. This one is what the holders say they are doing with the copies.

*Il Sole 24 Ore*, citing the attacker via *Corriere della Sera*, reports that the extortion of Revolut failed and the same people are now selling the set and offering victims a fee to be taken out of it before the sale. They claim at least 15 Italian citizens, more than the eight the authorities had named, plus others abroad who hold Italian documents. Material described as posted for proof includes transaction histories — one case said to run past 700 pages — photographs, and the identity documents used to open the accounts. KYC, addresses, phones, emails, bank details, fiat and crypto history. That is their inventory, not a regulator’s.

Revolut’s first public line was that it had not received a ransom demand. It then stopped commenting. The attackers say there was contact with people who presented themselves as the company, and no deal. Those two accounts can sit next to each other. Neither one deletes a file.

## Paying to be removed is the second shakedown

A promise to delete you, from the person selling you, is how the customer becomes the payer after the firm would not. There is no way to check the delete. The copy they already showed a journalist is the copy that matters, and it is not the only copy they can make after you pay.

The useful split is the same as the mailbox note. The channel that obtained the dossier was a certified government address. The channel that is shopping it now is the criminal. An officer, a client, or anyone whose KYC pack was in that 680 should assume the pack can be replayed: new-account fraud, a call that already knows the transaction, a document that looks like the one the bank already accepted.

## What not to do with the offer

Do not pay the removal fee. Do not send a fresh copy of the passport to “verify you are the victim.” Ask the institution, on a number from your own directory, what they have actually notified and which documents they will still treat as live. Rotate what can be rotated. The rest is already out if their sample is what the papers describe.

The mailbox was the breach. The sale is just the files changing hands again.