Fiber optic cables feed into a switch inside a communications room at an office in London, U.K., on Monday, May 21, 2018. The Department of Culture, Media and Sport will work with the Home Office to publish a white paper later this year setting out legislation, according to a statement, which will also seek to force tech giants to reveal how they target abusive and illegal online material posted by users. Photographer: Jason Alden/Bloomberg via Getty Images
Fiber optic cables feed into a switch inside a communications room at an office in London, U.K., on Monday, May 21, 2018. The Department of Culture, Media and Sport will work with the Home Office to publish a white paper later this year setting out legislation, according to a statement, which will also seek to force tech giants to reveal how they target abusive and illegal online material posted by users. Photographer: Jason Alden/Bloomberg via Getty Images
PHOTO: Bloomberg/Bloomberg/Bloomberg via Getty Images
Now playing
02:18
How to protect yourself from hackers
Iraqi security forces keep guard the site of a suicide attack in Baghdad, Iraq January 21, 2021. REUTERS/Thaier al-Sudani
Iraqi security forces keep guard the site of a suicide attack in Baghdad, Iraq January 21, 2021. REUTERS/Thaier al-Sudani
PHOTO: Thaier al-Sudani/Reuters
Now playing
02:42
Dozens killed and hundreds injured in Baghdad suicide blasts
PHOTO: Policia Nacional via Reters
Now playing
00:53
See the aftermath of the Madrid explosion
WILMINGTON, DELAWARE - JANUARY 15:  U.S. President-elect Joe Biden speaks during day two of laying out his plan on combating the coronavirus at the Queen theater January 15, 2021 in Wilmington, Delaware. President-elect Biden is announcing his plan to administer COVID-19 vaccines to Americans.  (Photo by Alex Wong/Getty Images)
WILMINGTON, DELAWARE - JANUARY 15: U.S. President-elect Joe Biden speaks during day two of laying out his plan on combating the coronavirus at the Queen theater January 15, 2021 in Wilmington, Delaware. President-elect Biden is announcing his plan to administer COVID-19 vaccines to Americans. (Photo by Alex Wong/Getty Images)
PHOTO: Alex Wong/Getty Images
Now playing
03:49
From Cuba to Delhi, CNN reporters on what Biden faces
PHOTO: Alexey Navalny
Now playing
02:35
Navalny urges his supporters to hit the streets
TOPSHOT - Russian President Vladimir Putin crosses himself as he plunges into the icy waters during the celebration of the Epiphany holiday in Moscow region on January 19, 2021. (Photo by Mikhail KLIMENTYEV / SPUTNIK / AFP) (Photo by MIKHAIL KLIMENTYEV/SPUTNIK/AFP via Getty Images)
TOPSHOT - Russian President Vladimir Putin crosses himself as he plunges into the icy waters during the celebration of the Epiphany holiday in Moscow region on January 19, 2021. (Photo by Mikhail KLIMENTYEV / SPUTNIK / AFP) (Photo by MIKHAIL KLIMENTYEV/SPUTNIK/AFP via Getty Images)
PHOTO: MIKHAIL KLIMENTYEV/SPUTNIK/AFP/Getty Images
Now playing
00:36
See Putin take part in traditional icy Epiphany dip
guatemala honduras migrants tear gas Oppmann intl ldn vpx_00000604.png
guatemala honduras migrants tear gas Oppmann intl ldn vpx_00000604.png
PHOTO: CNNE
Now playing
01:30
Authorities use tear gas and batons against US-bound migrants
PHOTO: Getty Images
Now playing
04:21
Here's where the UK-US special relationship could go under Biden
PHOTO: Getty Images
Now playing
02:41
Alexey Navalny arrested on his return to Moscow
Now playing
02:23
Tropical activity poses threat in Southern Hemisphere
PHOTO: Indonesia Search and Rescue Agency
Now playing
02:09
Woman who is trapped underneath earthquake's rubble captured on video
Barrie
Barrie's aunt speaks about how the police brought her the news about the death of her nephew Ibrahima.
PHOTO: VTM
Now playing
01:26
Aunt of Black man who died after arrest in Belgium: We want justice
screengrab US social media
screengrab US social media
PHOTO: Getty Images
Now playing
04:35
Tech companies ban Trump, but not other problematic leaders
Now playing
01:23
Rejected Tintin cover breaks world record for comic book art
africa china coronavirus vaccine diplomacy lu stout pkg vpx _00025522.png
africa china coronavirus vaccine diplomacy lu stout pkg vpx _00025522.png
PHOTO: CCTV
Now playing
03:09
How China is hoping to use its vaccine as a diplomatic tool
WASHINGTON, DC - JANUARY 13:  Speaker of the House Nancy Pelosi (D-CA) presides over the vote to impeach U.S. President Donald Trump for the second time in little over a year in the House Chamber of the U.S. Capitol January 13, 2021 in Washington, DC. The House voted to impeach Trump on the charge of "incitement of insurrection," 232-197 after a mob of his supporters attacked the U.S. Capitol where Congress was working to certify the Electoral College victory of President-elect Joe Biden on January 6. 10 Republicans voted to impeach. (Photo by Chip Somodevilla/Getty Images)
WASHINGTON, DC - JANUARY 13: Speaker of the House Nancy Pelosi (D-CA) presides over the vote to impeach U.S. President Donald Trump for the second time in little over a year in the House Chamber of the U.S. Capitol January 13, 2021 in Washington, DC. The House voted to impeach Trump on the charge of "incitement of insurrection," 232-197 after a mob of his supporters attacked the U.S. Capitol where Congress was working to certify the Electoral College victory of President-elect Joe Biden on January 6. 10 Republicans voted to impeach. (Photo by Chip Somodevilla/Getty Images)
PHOTO: Chip Somodevilla/Getty Images
Now playing
02:35
How the world is reacting to Trump's second impeachment
(CNN) —  

Asen Genov is pretty furious. His personal data was made public this week after records of more than 5 million Bulgarians got stolen by hackers from the country’s tax revenue office.

In a country of just 7 million people, the scale of the hack means that just about every working adult has been affected.

“We should all be angry. … The information is now freely available to anyone. Many, many people in Bulgaria already have this file, and I believe that it’s not only in Bulgaria,” said Genov, a blogger and political analyst. He knows his data was compromised because, though he’s not an IT expert, he managed to find the stolen files online.

The attack is extraordinary, but it is not unique.

Government databases are gold mines for hackers. They contain a huge wealth of information that can be “useful” for years to come, experts say.

“You can make (your password) longer and more sophisticated, but the information the government holds are things that are not going to change,” said Guy Bunker, an information security expert and the chief technology officer at Clearswift, a cybersecurity company.

“Your date of birth is not going to change, you’re not going to move house tomorrow,” he said. “A lot of the information that was taken was valid yesterday, is valid today, and will probably be valid for a large number of people in five, 10, 20 years’ time.”

Hackers’ paradise

Data breaches used to be spearheaded by highly skilled hackers. But it increasingly doesn’t take a sophisticated and carefully planned operation to break into IT systems. Hacking tools and malware that are available on the dark web make it possible for amateur hackers to cause enormous damage.

A strict data protection law that came into effect last year across the European Union has placed new burdens on anyone who collects and stores personal data. It also introduced hefty fines for anyone who mismanages data, potentially opening the door for the Bulgarian government to fine itself for the breach.

Still, attacks against government systems are on the rise, said Adam Levin, the founder of CyberScout, another cybersecurity firm. “It’s a war right now – one we will win if we make cybersecurity a front-burner issue,” he said.

The notion that governments urgently need to step up their cybersecurity game is not new. Experts have been ringing alarm bells for years.

The US Department of Veterans Affairs suffered one of the first major data breaches in 2006, when personal data of more than 26 million veterans and military personnel were compromised.

“And it was all, ‘Oh, this is dreadful. We must do things to stop it.’ … And here we are, 13 years later, and an entire country’s data has been compromised, and in between, there’s been incidents of large swathes of citizen data being compromised in different countries,” Bunker said.

Out-of-date systems are often the problem. Some governments may have used private companies to manage the data they collected before the array of hacks and breeches brought their attention to cybersecurity.

“In many cases, our data was sent to third-party contractors years ago,” Levin said. “The way we looked at data management 10 years ago seems antiquated today, yet that old data is still out there being managed by third parties, using legacy systems.”

If the “old data” hasn’t changed, it’s still valuable to hackers.

The Bulgaria incident is concerning, said Desislava Krusteva, a Bulgarian privacy and data protection lawyer who advises some of the world’s biggest tech companies on how to keep their clients’ information safe.

“These kinds of incidents should not happen in a state institution. It seems like it didn’t require huge efforts, and it’s probably the personal data of almost all Bulgarian citizens,” said Krusteva, a partner at Dimitrov, Petrov & Co., a law firm in Sofia.

The Bulgarian Commission for Personal Data Protection has said it would launch an investigation into the hack.

A National Revenue Agency spokesman would not comment on whether the data was properly protected.

“As there is undergoing investigation, we couldn’t provide more details about reasons behind the hack,” Communications Director Rossen Bachvarov said.

’Very embarrassing for the government’

A 20-year-old cybersecurity worker has been arrested by the Bulgarian police in connection with the hack. The computer and software used in the attack led police to the suspect, according to the Sofia prosecutor’s office.

The man has been detained, and the police seized his equipment, including mobile phones, computers and drives, the prosecutor’s office said in a statement. If convicted, he could spend as long as eight years in prison.

“It’s still too early to say what exactly happened, but from political perspective, it is, of course, very embarrassing for the government,” Krusteva said.

The embarrassment is made worse by the fact that this was not the first time the Bulgarian government was targeted. The country’s Commercial Registry was brought down less than a year ago by an attack.

“So, at least for a year, the Bulgarian society, politicians, those who are in charge of the country, they knew quite well about the serious cybersecurity problems in the government infrastructures,” Genov said, “and they didn’t do anything about it.”