Charges pressed against man detained for hacker attack on the Revenue Agency

Sofia city Prosecutor’s office on July 17 pressed charges against the 20 year-old man detained for the hacker attack on Bulgaria’s National Revenue Agency (NRA).

Sofia City Prosecutor's Office is in charge of the pre-trial investigation for a computer crime committed in connection with data that was copied and disseminated in the public domain about Bulgarian citizens and companies from the NRA's database. The attack was first reported on July 16, when several Bulgarian media said they received emails with data allegedly taken from the Finance Ministry’s servers.

Bulgaria’s National Revenue Agency said in a statement that its databases had been compromised by unauthorised access to about 3% of the information contained in its database.

Finance Minister Vladislav Goranov described the leak as highly unpleasant, but reassured that the leaked data was not enough to give the full picture of an individual’s financial state.

Goranov and Interior Minister Mladen Marinov, today participated in the Government’s security council meeting, called by Prime Minister Boyko Borissov in relation to the cyber attack.

Pre-trial proceedings commenced with an urgent interview of a witnesses and as the only opportunity to collect and retain evidence from the investigating police officer from the directorate for combatting organised crime.

In the course of the investigation it was identified that the file sent to the media and is in the internet contains personal and financial data of more than 5,000,000 Bulgarian and foreign citizens and companies, including names, personal identity number of Bulgarian citizens, names and single identification code of companies, tax and social security records from annual tax returns received in the revenue agency from other institutions in Bulgaria under the international exchange of information in the information system VAT REFUND, used by the NRA, stored on an NRA server. It has been found that one of the files has data identifying the name of a specific computer configuration, unique username, date, time, and software application that served to read the file. As a result of the investigation and intelligence actions it was found that the user name was used by K.B., 20 years old from Plovdiv.

On July 16, 2019, officials from the directorate for combatting organized crime found that K.B. is at work in an office of a company in Sofia, where he was detained for 24 hours under the MoI Law. He is a cyber security expert and is involved in testing and auditing information systems.

The actions of K.B., for which he was detained, have no connection with the business of the company in which he works.