Bulgarian police said on Wednesday they have arrested a suspect for a cyber attack on the country’s National Revenue Agency (NRA), which led to the leak of personal and financial data of millions of people.
“We have a suspect that has been detained,” a police spokeswoman said, declining to elaborate.
The breach on the NRA happened at the end of June and is considered to be the biggest leak in the country with hackers securing names, personal data and financial earnings of individuals and companies.
The NRA said on Tuesday that about 3% of its databases were breached, which the purported hacker said in an email to local media — in which they also offered access to the stolen data — involved about five million people in the nation of seven million.
Finance Minister Vladislav Goranov apologised “to all Bulgarian citizens who were made vulnerable” after being summoned to parliament for an explanation.
He also said that an initial analysis of the stolen data showed it was not enough to draw “substantive conclusions” about any citizen’s financial situation and warned that anyone seeking to exploit the data “would fall under the impact of Bulgarian law”.
Local media speculated the attack may have been carried out to highlight the vulnerabilities of the country’s cyberinfrastructure.
The Bulgarian Industrial Association — the country’s leading business organisation — said in a statement that it had raised concerns about the government’s cybersecurity standards a year ago after the country’s commercial registration system went dark for half a month.
Interior Minister Mladen Marinov said the country would seek help from the EU cybersecurity agency to audit its most sensitive systems.
