The Sofia City Prosecutor’s Office directs the investigation into pre-trial proceedings for a computer crime in connection with copied and publicly distributed information about Bulgarian citizens and commercial companies from the National Revenue Agency’s (NRA) data, the Prosecutor’s Office said. Pre-trial proceedings commenced with the first investigative action – a witness interrogation conducted under urgent circumstances and as the only opportunity to collect and retain evidence from an investigating police officer in the General Directorate “Combating Organized Crime”.
The investigation was launched after emergency operations and searches by members of the Cyber Crime Department at the General Directorate for Combating Organized Crime. In the course of these actions and with the assistance of Information Services it was established that the file, which is sent to the media and exists on the Internet, contains data for over 5 000 000 Bulgarian and foreign citizens and commercial companies, including full names and identification numbers of Bulgarian citizens, names of traders, tax and insurance information on submitted annual declarations received from NRA by other institutions in Bulgaria on the international exchange of information in the VAT REFUND information system, used by NRA, stored in a server of NRA and others.
It has been found that one of the files has data identifying the name of a specific computer configuration, unique username, date, time, and software application that served to read the file. As a result of the actions, it was found that the user name was used by a 20-year-old man from Plovdiv. On July 16th, General Directorate “Combating Organized Crime” members found that he was working in an office in a company in Sofia where he was detained for 24 hours. He is a cyber security expert and is involved in testing and auditing information systems. The actions of the young person have no connection with the activity of the company in which he works.
Under urgent circumstances, under the leadership of the Sofia City Prosecutor’s Office, searches and seizures were carried out in the office of the company where the man was found, as well as in his home in Sofia and Plovdiv. In these actions, computer configurations, hard drives, flash drives and 2 mobile phones were seized. Technical and computer expertise is appointed, witnesses are questioned. The evidence gathered so far has been assessed by the Sofia City Prosecutor’s Office as sufficient to justify the attraction of the man to criminal liability.
He is accused of having unlawfully copied computer data from a NRA server from an unsettled date to July 15th 2019 in Sofia. The act is an insignificant case and has been committed against an information system that is part of the critical infrastructure for which a penalty of imprisonment of five to eight years is imposed and a fine of up to ten thousand levs. The Sofia City Prosecutor’s Office ordered the detention of the young person for up to 72 hours.