Bulgarian National Revenue Agency breach

On 15 July 2019, an anonymous hacker emailed Bulgarian newsrooms a trove of data stolen from the National Revenue Agency (NAP), the country's tax authority. The leak — eventually confirmed to cover 6,074,140 data subjects — exposed records on almost the entire adult population of Bulgaria, making it the largest data breach in the country's history.

What happened

The intrusion began in June 2019, when the attacker found and exploited a SQL injection vulnerability in a rarely-used online service for VAT refunds. SQL injection — passing crafted input that the application executes as database commands — let the attacker read directly from NAP's back-end databases without any privileged access. Over an extended period the attacker pulled down dozens of database tables.

On 15 July the hacker emailed Bulgarian media with sample files and a message mocking the state of Bulgarian cybersecurity, claiming to hold more than 110 folders and around 21 gigabytes of data. About 11 GB in 57 folders circulated publicly. NAP confirmed the data's authenticity the next day.

Impact

• Leaked records included full names, national identity numbers, addresses, income and tax data, social-security and pension contributions, health-related payments, and a register of online-gambling users — spanning from 2007 to mid-2019.
• The CPDP's investigation found data on 6,074,140 people was compromised: roughly 4.1 million living Bulgarian and foreign citizens and 1.96 million deceased.
• In a country of about 7 million, this represented nearly every living adult.

Investigation and penalty

Bulgarian police arrested Kristian Boykov, a 20-year-old penetration tester employed by a local cybersecurity firm, the day after the leak. He denied involvement and was released within days; the prosecution's case never produced a conviction, and the true perpetrator remains officially unconfirmed.

The data-protection regulator CPDP fined NAP 5.1 million BGN (about EUR 2.6 million) on 29 August 2019 for failing to implement adequate technical and organisational safeguards — one of the largest GDPR penalties in the EU at the time. Bulgarian courts later upheld the fine.

Why it matters

The NAP breach is a textbook example of a single application-layer flaw cascading into a national-scale exposure. A web vulnerability that a routine code review or web-application firewall should have caught instead surfaced the tax and identity records of an entire nation. It became the reference case in EU debates — including a formal European Parliament question — about whether member-state administrations holding mandatory citizen data were meeting their GDPR security obligations.