A specialist in the field of cyber security and white hat hacker, who is accused of hacking the data of more than 5 million Bulgarian taxpayers, was released by the police on Wednesday as it appears he will face a smaller penalty than was originally assigned to him.
Kristian Boykov, a 20-year-old Bulgarian working in cyberspace, was arrested last week in the capital of Bulgaria in connection with the breach. Police raided his home and seized computers and mobile devices with encrypted information. The hacker was identified by the police through the computer and the software used for the attack, according to the prosecutor's office in Sofia.
Due to his work, which involves testing computer networks for potential vulnerabilities, some believe that Boykov is a “white hat hacker” – a hacker who infiltrates computer networks to expose vulnerabilities and help them be fixed.
In 2017, he hacked the website of the Ministry of Education to expose its vulnerabilities. In a television interview, he described the project as “fulfilling my duty to the bourgeoisie.”
Prosecutors in Sofia claim to have identified one of the stolen files from the latest data breach with a username Boykov could have used. Boykov and his lawyer deny the allegations against him and say he was not involved in the incident.
The hack of the tax authority database is believed to be the largest data breach in Bulgaria’s history. Almost every working adult in Bulgaria was affected. In a country of seven million people, more than five million pieces of data, including social security information, addresses, incomes and names, were leaked and made easily accessible online.
Boykov was initially charged with “computer crimes” against critical infrastructure, which carries a maximum sentence of eight years in prison. Those charges were dropped and he was charged with crimes against information systems, which carry a maximum sentence of three years in prison.
The original hack is believed to have occurred in June. The breach remained hidden until an e‑mail from a Russian email address was sent to Bulgarian news agencies last week, taking responsibility for the attack. In the email, the sender claimed to be a Russian hacker, provided links for download with the stolen information, mocking Bulgaria's efforts regarding cybersecurity.
The police are in the early stages of the investigation. If Boykov is actually involved, it is unknown whether he worked alone or as part of a larger group, but the police are considering external involvement as a possibility.
According to The New York Times, some senior Bulgarian officials have reported that Russia may have been behind the attack, indeed as retaliation for the country's purchase of American fighter jets.
A data protection law was implemented across the European Union last year , imposing fines on companies that fail to carry out certain procedures regarding their data. Bulgaria's tax authority faces a fine of up to 20 million euros, or $22.4 million, for the data breach .
Experts who examined stolen data in Bulgaria said the hack was not a complex operation and that the government was to blame for the lack of preventive action. Old computer systems are particularly vulnerable to breaches. Less than a year ago, the country's Commercial Registry was hit by another cyberattack.
Prime Minister Boyko Borisov said at a government meeting on Wednesday that Boykov is an excellent hacker and that the country should hire such people to work for the state.
