The Subpoena Desk Is the Breach — Fake Government Data Requests Pull Customers' Files — severe-but-plausible scenario — ITOL

Vector: Cyber · Severity: severe

A records request arrives from a real government email domain. The agency's mailbox was compromised, so every authentication check passes. The legal-process desk, which answers thousands of subpoenas, 314(a) requests (FinCEN's information-request process) and court orders a year, answers this one the usual way. The reply carries the whole KYC (know your customer) file for each customer named: passport and licence scans, the verification selfie, statements, account numbers and the full transaction history. Weeks later the files appear on Telegram with a ransom demand, and the named customers, chosen because they are wealthy, start getting calls from people who know everything about them.