Third suspect faces charges over Bulgaria taxpayer data hack

SOFIA, Bulgaria – Bulgarian prosecutors were on Tuesday, July 30, preparing to charge a third suspect over a massive hack and leak of taxpayer data, which authorities said affected almost every adult in the country.

A 20-year-old cyber-crime specialist and his senior manager had already been charged last week with "cyber-terrorism" over the attack. It saw thousands of tax agency files leaked to the press in mid-July.

Both worked for a company which was supposed to advise other firms on how to withstand cyber-attacks.

The company owner, who was abroad at the time, was detained on Tuesday morning at Sofia airport and will face the same charges, the prosecution said in a statement.

The 3 men are being investigated as an organised group that "aimed at creating panic and fear among the population" through cyber-crime.

Bulgaria's penal code regards such an offence as "terrorism" and if convicted, the men risk between 5 and 15 years in jail.

The tax agency said that as many as 5.1 million people – practically Bulgaria's whole adult population – were affected by the attack.

They had all or part of their personal records hacked, including in some cases their identity card numbers and 10-digit personal numbers that contain their full date of birth and four extra digits.

The hackers also got access to people's addresses, declared income and other sensitive data.

The unprecedented breach has sparked anxiety among Bulgarians who feared their data might be used for fraudulent purposes.

Prosecutors also say they have evidence that the tax authority was not the group's only target.

According to a prosecution statement, the three men also hacked and copied information from servers of an insurance company and an internet service provider. –