Personal details of ‘practically the whole adult population’ of entire country stolen
Person claiming to be hacker described government cyber security efforts as 'parody'
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.The personal details of almost every adult in Bulgaria have been leaked as part of a huge cyber attack.
Millions of taxpayers' private and financial data was part of the hack, officials said.
The data was stolen from Bulgaria's NRA tax agency, which could now face a subsantial fine over the data breach. It is the biggest ever to hit the Balkan country, affecting almost every single adult among the 7 million poeple who live in the country.
Officials say they have arrested a 20-year-old cyber security worker on suspicion of being involved with the attack.
Yavor Kolev, head of the police's cybersecurity unit, said the unidentified man was arrested on Tuesday afternoon. Officers raided his home and office in the capital Sofia and seized computer devices containing encrypted data.
"Overnight, the relevant examination was carried out, a very initial one, which suggests that the suspect is connected to the crime," Kolev said.
The investigation into the hack is still at an early stage, he added, and police are looking into the possibility that other people were involved.
Sofia city prosecutors said the 20-year-old man had been charged with a computer crime and would be held for another three days.
The attack has reignited a long-running debate about lax cybersecurity standards in Bulgaria. A person claiming to be a Russian hacker and responsible for the breach emailed local media on Monday and denounced the government's cybersecurity efforts as a "parody".
Kolev said the arrested man was a researcher who tested computer networks for possible vulnerabilities to prevent cyber attacks. But he had also engaged in some criminal activity, Kolev added: "In his life, he has been on both sides."
Speaking at a government meeting on Wednesday, Prime Minister Boyko Borissov described the arrested man as a "wizard" hacker and said the country should hire similar "unique brains" to work for the state rather than against it.
But some experts who have examined the stolen data said the techniques used in the attack were relatively basic and spoke more to a lack of adequate data protection measures than the hacker's ability.
"The reason for the success of the attack does not seem to be the sophistication of the hacker, but rather poor security practices at the NRA," said Bozhidar Bozhanov, chief executive at cybersecurity firm LogSentinel.
Bulgaria's tax agency now faces a fine of up to 20 million euros, or 4% of its annual turnover over the data breach, said Veselin Tselkov, a board member at the Commission for Personal Data Protection.
"The amount of the sanction depends on the number of people affected and the volume of leaked information," he told Reuters, adding that the commission was still waiting for full report on the attack.
Bulgaria's leading business organisation BIA, which warned about possible flaws in the tax agency's data protection system a year ago, demanded that detailed information for the leaked documents be sent to every person and company affected.
"We need to know so that at least we can be aware of possible dangers," said BIA deputy head Stanislav Popdonchev.
Bulgaria's finance minister Vladislav Goranov has apologised for the attack, which exposed the names of millions of people and companies and revealed information about incomes, tax declarations, health insurance payments and loans.
The hack happened at the end of June and compromised about 3% of the tax agency's database. Officials said earlier this week initial signs suggested it was conducted from abroad.
Additional reporting by agencies
Join our commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies
Comments