Bulgarian National Revenue Agency data breach: 471K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2019-07-18
In July 2019, a massive data breach of the Bulgarian National Revenue Agency began circulating with data on 5 million people. Allegedly obtained in June, the data was broadly shared online and included taxation information alongside names, phone numbers, physical addresses and 471 thousand unique email addresses. The breach is said to have affected "nearly all adults in Bulgaria". Exposed data: email addresses, names, phone numbers, physical addresses, taxation records. The breach dates from Jul 15, 2019; Have I Been Pwned loaded it on Jul 18, 2019.
What to do
- If you had a Bulgarian National Revenue Agency account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
