Data on thousands of customers of about a dozen companies reached hacker forums through a 19-year-old from Sofia, police and prosecutors say. The organised crime unit GDBOP and the Sofia City Prosecutor's Office say he was detained on 28 October 2026 and charged. His case is only starting, and no court has convicted him.

GDBOP's cybercrime directorate ran the operation under prosecutors' supervision. The man, known only by the initials M. P., broke into websites and systems of state and municipal bodies, private firms and the national broadcasters BNT and BNR, investigators say. Officers seized computers, hard drives, phones and documents from addresses in Sofia.

What the man is charged with and who is affected

Prosecutors have brought three charges, the daily 24 Chasa reported on 29 October. One outlet speaks of four offences but lists three counts under the Criminal Code: unlawful access to information systems (Article 319a, paragraph 1), copying a database with personal data (Article 319b, paragraph 3 in conjunction with paragraph 1) and unlawful alteration of computer data (Article 319b, paragraph 1). The law sets five to seven years in prison for them, 24 Chasa reported.

According to the charges, the stolen data includes names, phone numbers, email and postal addresses, online purchase history and other personal information. Only 24 Chasa adds national ID numbers (EGN); other outlets do not mention them. Some sources also write about email correspondence.

He did it for profit, investigators say. The data was offered for sale online and on specialised hacker forums. The man also called on others to spread the malware "Cobra Stealer". Such programs secretly pull saved passwords, bank details and crypto wallets from infected computers.

How he worked, according to the interior ministry

The man used artificial intelligence to extract personal data and spread malware, according to an interior ministry statement relayed by the media. The statement does not say how. Some outlets add that he also used anonymising services to hide his tracks, and two aliases on social media. Not all reports mention the services, and the BNT website does not.

In practice, anonymising services are programs and networks that hide a person's real internet address. That makes an attack hard to trace to a specific computer.

What to do if your data has leaked

A prosecutor from the Sofia City Prosecutor's Office extended his detention to 72 hours. According to 24 Chasa, prosecutors planned to ask the Sofia City Court on 31 October to order the harshest measure, remand in custody. The reports reviewed do not say whether the court has ruled. Officials are still working out how many systems were hit and exactly what data was stolen.

Companies whose data has leaked must tell the data protection regulator within 72 hours. They must tell the people affected without undue delay if their rights are likely to be at high risk. The notice must include a contact point, a description of the consequences and advice.

Anyone who gets such a notice should take a few steps. The first is to change the password on the affected service and everywhere else they used the same one. The second is to turn on two-factor protection, which adds a second check on top of the password, so a stolen password alone is not enough. The third is to watch bank accounts for unusual transactions.

The biggest danger is targeted phishing, where fraudsters gather details about a specific person to look convincing. After a leak of purchase history, a message could easily arrive from a "shop" that knows what was ordered and to which address, and asks to "confirm" a payment or card details. Experts advise checking the sender's real address, not opening unexpected links and attachments, and not replying to suspicious messages, because a reply confirms the address is active. It is safer to go to the company's website through your own browser or call its official phone number.

Until a verdict takes effect, the man is presumed innocent. The Sofia City Court will decide next on his pre-trial measure.