GDBOP officers detained a 19-year-old man in Sofia on Wednesday, 28 October, over a series of cyber attacks on companies, media outlets and state and municipal bodies. The organised crime unit says he sold the stolen personal data online.

GDBOP's cybercrime directorate tracked him down and detained him within days. The Sofia City Prosecutor's Office oversees its work.

Evidence shows the man broke into computer systems without permission and downloaded personal data and email correspondence. He then offered it for sale on online channels and hacker forums, using two aliases on social media and elsewhere online.

He used artificial intelligence to help with the attacks and tried to cover his tracks with anonymising services. There are also indications that he urged others to spread "Cobra Stealer", malware designed to steal information.

The attacks hit about a dozen companies and, through them, thousands of their customers and users.

The stolen data includes names, phone numbers, emails, postal addresses, online purchase histories and other personal details.

Investigators also have evidence that websites of state and municipal bodies were breached, along with those of national media, including Bulgarian National Television and Bulgarian National Radio.

During the investigative actions, police seized electronic devices, storage media and documents related to the case.

The man has been charged under four articles of the Criminal Code. They cover unlawful access to computer systems (Article 319a, paragraph 1), copying databases containing personal data (Article 319b, paragraph 3, in conjunction with paragraph 1) and unlawful alteration of computer data in a system where the case is not minor (Article 319b, paragraph 1).

In an order, the supervising prosecutor from the Sofia City Prosecutor's Office extended his detention to 72 hours. A court will decide what preventive measure to impose.

Follow-up: Man, 19, charged over hacks of institution websites, BNT and BNR