Revolut confirmed on Saturday that customer data was taken after attackers posed as government officials and filed fraudulent information requests. The company said it has notified affected customers and alerted law enforcement and financial regulators.

The incident is a reminder that a lot of modern “hacking” is paperwork. If a company has a legal process for handing over records, someone will try to impersonate the process. Revolut says the core ledger was not touched. The records around it were.