Bulgarian National Revenue Agency – 471,167 Taxpayer Records Exposed
What Happened – In July 2019 a breach of the Bulgarian National Revenue Agency (nap.bg) was disclosed, revealing personal taxation records for roughly 471 k individuals. The leaked dataset included email addresses, full names, phone numbers, physical addresses and tax‑related information, representing nearly all adult residents of Bulgaria.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate data‑protection controls and the need for continuous monitoring of who can access sensitive taxpayer data.
- Demonstrable evidence of privacy‑by‑design practices (e.g., consent management, DSAR readiness) is essential for a defensible audit trail under GDPR‑style obligations.
- A robust privacy‑control assurance program can surface gaps before they become public exposures, supporting both regulatory compliance and stakeholder trust.
Who Is Affected – Government and public‑sector entities that collect, store, or process personal tax information; any organization handling EU personal data.
Recommended Actions
- Conduct an immediate privacy‑impact assessment of all tax‑related data stores.
- Verify that consent, data‑retention, and access‑control policies align with GDPR‑style requirements; remediate any gaps.
- Capture and archive evidence of these controls in a centralized Trust Center to streamline future audits.
Technical Notes – The breach was publicly reported via Have I Been Pwned; the exact attack vector was not disclosed, but the exposure involved bulk extraction of personal records from the agency’s systems. Source: https://haveibeenpwned.com/api/v3/breach/BulgarianNationalRevenueAgency