A forged request sent from inside a real government domain was enough to pull identity documents, selfies, and Bitcoin histories…