Asen Genov is pretty furious. His personal data was made public this week after records of more than 5 million Bulgarians got stolen by hackers from the country’s tax revenue office.
In a country of just 7 million people, the scale of the hack means that just about every working adult has been affected.
“We should all be angry. … The information is now freely available to anyone. Many, many people in Bulgaria already have this file, and I believe that it’s not only in Bulgaria,” said Genov, a blogger and political analyst. He knows his data was compromised because, though he’s not an IT expert, he managed to find the stolen files online.
The attack is extraordinary, but it is not unique.
Government databases are gold mines for hackers. They contain a huge wealth of information that can be “useful” for years to come, experts say.
“You can make (your password) longer and more sophisticated, but the information the government holds are things that are not going to change,” said Guy Bunker, an information security expert and the chief technology officer at Clearswift, a cybersecurity company.
“Your date of birth is not going to change, you’re not going to move house tomorrow,” he said. “A lot of the information that was taken was valid yesterday, is valid today, and will probably be valid for a large number of people in five, 10, 20 years’ time.”
Data breaches used to be spearheaded by highly skilled hackers. But it increasingly doesn’t take a sophisticated and carefully planned operation to break into IT systems. Hacking tools and malware that are available on the dark web make it possible for amateur hackers to cause enormous damage.
A strict data protection law that came into effect last year across the European Union has placed new burdens on anyone who collects and stores personal data. It also introduced hefty fines for anyone who mismanages data, potentially opening the door for the Bulgarian government to fine itself for the breach.
Still, attacks against government systems are on the rise, said Adam Levin, the founder of CyberScout, another cybersecurity firm. “It’s a war right now – one we will win if we make cybersecurity a front-burner issue,” he said.
The notion that governments urgently need to step up their cybersecurity game is not new. Experts have been ringing alarm bells for years.
The US Department of Vetera