View source for 2019 Bulgarian Revenue Agency hack

{{Infobox event|title=2019 Bulgarian National Revenue Agency hack|image=|image_size=|image_alt=|caption=|native_name=|native_name_lang=|english_name=|time=|duration=|date=15 July 2019 (revealed)|venue=|location={{BUL}}}}
On 15 July 2019, a massive data breach of the National Revenue Agency (NRA) of [[Bulgaria]] was revealed. The hacker responsible for the breach sent an email to major Bulgarian media outlets, detailing the scope of the attack. 

The leaked data amounted to 57 folders with [[Comma-separated values|.csv]] files detailing the names and [[national identification number]]s of some 5 million Bulgarian citizens, as well as records on revenues, tax and social security payments, debts, online betting data and company activities dating back as early as 2007, and as recently as June 2019.<ref name=kapital1>{{cite web|url=https://www.capital.bg/politika_i_ikonomika/bulgaria/2019/07/15/3938624_ot_nap_sa_iztekli_lichni_danni_na_milioni_bulgarski/|title=Personal data of millions of Bulgarian citizens leaked from NRA|publisher=Kapital Daily|date=15 July 2019|access-date=21 July 2019|language=bg}}</ref> According to some researchers, nearly every adult in the country had their personal data compromised.<ref name=reuters1>{{cite web|url=https://www.reuters.com/article/us-bulgaria-cybersecurity/hackers-steal-millions-of-bulgarians-financial-records-tax-agency-idUSKCN1UB0MA|title=In systemic breach, hackers steal millions of Bulgarians' financial data|publisher=Reuters|date=16 July 2019|access-date=22 July 2019}}</ref>

== Background ==
Successive Bulgarian governments have spent nearly two billion [[Bulgarian lev|leva]] ($1.15 billion) on [[e-government]] projects since 2002, producing few results. The National Revenue Agency is one of only five entities that provide e-government services to citizens.<ref>{{cite web|url=https://www.novinite.com/articles/185891/About+BGN+2+Billion+have+been+Spent+on+the+Absent+Bulgarian+E-government+for+15+years|title=About BGN 2 Billion have been Spent on the Absent Bulgarian E-government for 15 years|publisher=Novinite|date=5 December 2017|access-date=22 July 2019}}</ref> A 2018 government report indicated a very low level of cybersecurity at government entities, citing a lack of qualified IT employees in public agencies and noncompetitive salaries compared to the private sector.<ref>{{cite web|url=https://www.segabg.com/node/81845|title=Cybersecurity is tragic despite millions spent|publisher=Sega|date=19 July 2019|access-date=22 July 2019}}</ref>

In 2017, personal data including addresses and names of 1.2 million Bulgarian children was openly accessible on a Ministry of Education website and the leak was not addressed until it was revealed by a report on investigative journalism website [[Bivol.bg]].<ref>{{cite web|url=https://bivol.bg/en/new-education-ministry-platform-open-and-safe-school-displayed-personal-data-of-1-2-million-bulgarian-children.html|title=EDUCATION MINISTRY'S NEW PLATFORM "OPEN AND SAFE SCHOOL" DISPLAYED PERSONAL DATA OF 1.2 MILLION BULGARIAN CHILDREN|publisher=Bivol.bg|date=10 October 2017|access-date=22 July 2019}}</ref> 

Serious doubts over government capacity to handle data continued in August 2018, when the Bulgarian Commercial Register, which contains the entire database of the Bulgarian economy, crashed.<ref name=SBS>{{cite web|url=https://www.sbs.com.au/yourlanguage/bulgarian/en/audiotrack/commercial-register-bulgaria-collapsed|title=The Commercial Register in Bulgaria Collapsed|publisher=SBS Australia|date=24 August 2018|access-date=22 July 2019}}</ref> A total [[hard disk drive failure]] caused by sloppy maintenance left 25 [[terabyte]]s of company data inaccessible for more than two weeks, essentially halting business transactions.<ref>{{cite web|url=https://bnr.bg/en/post/101007646/crash-of-commercial-register-of-bulgaria-blocks-business-deals|title=Crash of commercial register of Bulgaria blocks business deals|publisher=Bulgarian National Radio|date=15 August 2018|access-date=22 July 2019}}</ref><ref>{{cite web|url=https://www.dnevnik.bg/bulgaria/2018/08/27/3301959_turgovskiiat_registur_shte_zaraboti_napulno_v_16_chasa/|title=Commercial Register Set to Resume Work in 16:00|publisher=Dnevnik|date=27 August 2018|access-date=22 July 2019|language=bg}}</ref><ref>{{cite web|url=https://www.mediapool.bg/the-trade-registry-now-down-a-full-week-head-of-the-registry-agency-resigns-npp-belene-devours-a-new-million-news282865.html|title=The Trade Registry Now Down a Full Week|publisher=Mediapool|date=18 August 2018|access-date=22 July 2019}}</ref> Following the crash, the e-Government State Agency began an audit of software and hardware used by all government entities.<ref>{{cite web|url=https://dariknews.bg/novini/bylgariia/v-edinno-hranilishte-shte-paziat-kopie-na-dyrzhavnite-registri-2114732|title=State Registry Copies Will be Kept in a Single Storage|publisher=Darik News|date=15 August 2018|access-date=22 July 2019}}</ref> Later that year, a Cybersecurity Law came into effect, establishing a National Cybersecurity System along with several government positions related to cybercrime and accident prevention.<ref>{{cite web|url=https://dariknews.bg/novini/bylgariia/parlamentyt-prie-nov-zakon-za-kibersigurnostta-2128916|title=Parliament Adopts New Cybersecurity Law|publisher=Darik News|date=31 October 2018|access-date=22 July 2019}}</ref>

A few days before the NRA hack was revealed, a [[white hat hacker]] reported serious vulnerabilities in the Bulgarian Commission for Personal Data Protection website; the hacker had "begged" the Commission to fix the issues for three years. The Commission did not take any action to protect the data, which included emails and phone numbers of more than 14,000 citizens.<ref>{{cite web|url=https://bivol.bg/en/for-3-years-white-hat-begs-data-protection-watchdog-to-stop-leaks-from-its-site.html|title=FOR 3 YEARS WHITE HAT 'BEGS' DATA PROTECTION WATCHDOG TO STOP LEAKS FROM ITS SITE|publisher=Bivol.bg|date=12 July 2019|access-date=22 July 2019}}</ref>

== Attack ==
On 15 July, an anonymous hacker emailed Bulgarian media outlets with details of an attack carried out against "servers of the Ministry of Finance".<ref name=kapital1/> The leak revealed 11 gigabytes of data taken from National Revenue Agency databases. The 57 folders included .csv files, some with more than 1 million lines, containing full names, national identification numbers, revenue figures, personal debt information, health and pension payments, and a register of [[online gambling]] website users. The email also claimed that the entire volume of data amounted to 110 folders and 21 gigabytes. The message called the Bulgarian government "retarded", its computer security "parodic", and called for [[Julian Assange]] to be freed.<ref name=kapital1/> 

On the following day, the NRA confirmed the authenticity of the data. According to the agency, its servers were accessed through a rarely used [[Value-added tax|VAT]] refund service for deals abroad, and the breach had affected about 3% of their total database.<ref name=kapital2>{{cite web|url=https://www.capital.bg/politika_i_ikonomika/bulgaria/2019/07/16/3938976_nap_haknatite_danni_sa_avtentichni_te_sa_okolo_3_ot/|title=Personal data of millions of Bulgarian citizens leaked from NRA|publisher=Kapital Daily|date=15 July 2019|access-date=21 July 2019|language=bg}}</ref> 

The hacker deployed a [[SQL injection]] and randomly collected data from the servers.<ref name=kapital3>{{cite web|url=https://www.capital.bg/politika_i_ikonomika/bulgaria/2019/07/19/3940270_durjavata_s_nai-otvorenite_danni_v_sveta/|title=The Country With the Most Open Data in the World|publisher=Kapital Daily|date=19 July 2019|access-date=21 July 2019|language=bg}}</ref>

== Aftermath ==
=== Arrest of Kristiyan Boykov ===
Kristiyan Boykov, a 20-year-old employee of a cybersecurity company, was arrested on 16 July by police in [[Sofia]] and charged with breach and theft of personal data.<ref name=MTR>{{cite web|url=https://www.technologyreview.com/f/613973/what-happens-when-a-countrys-entire-adult-population-is-h|title=What happens when a country's entire adult population is hacked?|publisher=[[MIT Technology Review]]|date=17 July 2019|access-date=21 July 2019}}{{Dead link|date=January 2022 |bot=InternetArchiveBot |fix-attempted=yes }}</ref> 

According to police, the released data also contained a [[lock file]] with information about the attacker's computer and username, which matched the one Boykov used in social media. The lock file, however, was dated before the supposed time of the attack.<ref name=kapital3/> 

Boykov was released on 18 July, on the grounds that his attack had not affected critical NRA databases.<ref>{{cite web|url=https://www.novinite.com/articles/198653/Suspect+Arrested+for+NRA+Hacker+Attack+Released+from+Detention|title=Suspect Arrested for NRA Hacker Attack Released from Detention|publisher=Novinite|date=18 July 2019|access-date=21 July 2019}}</ref> He denied carrying out the attack, stating that police had asked him "uncomfortable questions", used "slight intimidation", and attempted to extract a [[forced confession]].<ref name=dir1>{{cite web|url=https://dnes.dir.bg/obshtestvo/kristiyan-boykov-ne-sam-az-chovekat-koyto-probi-sistemata-na-nap|title=Kristiyan Boykov: I'm not the man who broke into NRA's system|publisher=Dir.bg|date=22 July 2019|access-date=22 July 2019|language=bg}}</ref> His lawyer announced that the evidence against Boykov is "non-existent", and that the accusation neither points to a specific time period or even a perpetrator. According to Boykov and his employers, a market competitor may have used the occasion to frame him and cause damage to their company.<ref name=kapital3/><ref name=dir1/>

=== Commission for Personal Data Protection hack attempt ===
On July 22, the Commission for Personal Data Protection announced that an unsuccessful cyber attack had been carried out against it. It remains unknown if the database was targeted, but the attacker had used the local [[Wi-Fi]] network and was apparently in the vicinity of the Commission's headquarters.<ref>{{cite web|url=https://dnes.dir.bg/obshtestvo/osuetiha-hakerska-ataka-sreshtu-komisiyata-za-zashtita-na-lichnite-danni|title=Hacking attempt against the Personal Data Commission prevented|publisher=Dir.bg|date=22 July 2019|access-date=22 July 2019|language=bg}}</ref>

== Reactions ==
=== Government ===
{{empty section|date=October 2019}}
=== Political groups ===
{{empty section|date=October 2019}}
=== Industry ===
Bulgarian IT professionals launched an [[online petition]] demanding [[open source]] software infrastructure for government services. The petition also demanded clarity on the billions spent on e-government since 2002 without noticeable results.<ref>{{cite web|url=https://it.dir.bg/tehnologii/programisti-iskat-otvoren-kod-na-softuernite-sistemi-v-balgarskite-institutsii|title=Programmers demand open code for software at Bulgarian institutions|publisher=Dir.bg|date=27 July 2019|access-date=28 July 2019}}</ref>

== See also ==
* [[List of data breaches]]

== References ==
{{Reflist}}

{{Hacking in the 2010s}}

[[Category:2019 in computing]]
[[Category:2019 in Bulgaria]]
[[Category:Cyberattacks|Bulgaria]]
[[Category:Hacking in the 2010s]]
[[Category:July 2019 events in Bulgaria]]