An entire nation just got hacked
An entire nation just got hacked
Updated 1418 GMT (2218 HKT) July 21, 2019
(CNN)Asen Genov is pretty
furious. His personal data was made public this week after records of more than
5 million Bulgarians got stolen by hackers from the country's tax
revenue office.
In a country of just 7
million people, the scale of the hack means that just about
every working adult has been affected.
"We should all be
angry. ... The information is now freely available to anyone. Many, many people
in Bulgaria already have this file, and I believe that it's not only in
Bulgaria," said Genov, a blogger and political analyst. He knows his data
was compromised because, though he's not an IT expert, he managed to find the
stolen files online.
The attack is
extraordinary, but it is not unique.
Government databases are
gold mines for hackers. They contain a huge wealth of information that can be
"useful" for years to come, experts say.
"You can make (your
password) longer and more sophisticated, but the information the government
holds are things that are not going to change," said Guy Bunker, an
information security expert and the chief technology officer at Clearswift, a
cybersecurity company.
"Your date of birth is
not going to change, you're not going to move house tomorrow," he said.
"A lot of the information that was taken was valid yesterday, is valid
today, and will probably be valid for a large number of people in five, 10, 20
years' time."
Hackers' paradise
Data breaches used to be
spearheaded by highly skilled hackers. But it increasingly doesn't take a
sophisticated and carefully planned operation to break into IT systems. Hacking
tools and malware that are available on the dark web make it possible for amateur
hackers to cause enormous damage.
A strict data protection law that came into
effect last year across the European Union has placed new burdens on anyone who
collects and stores personal data. It also introduced hefty fines for anyone
who mismanages data, potentially opening the door for the Bulgarian government
to fine itself for the breach.
Still, attacks against
government systems are on the rise, said Adam Levin, the founder of CyberScout,
another cybersecurity firm. "It's a war right now -- one we will win if we
make cybersecurity a front-burner issue," he said.
The notion that governments
urgently need to step up their cybersecurity game is not new. Experts have been
ringing alarm bells for years.
The US Department of
Veterans Affairs suffered one of the first major data breaches in 2006, when
personal data of more than 26 million veterans and military personnel were
compromised.
"And it was all, 'Oh,
this is dreadful. We must do things to stop it.' ... And here we are, 13 years
later, and an entire country's data has been compromised, and in between,
there's been incidents of large swathes of citizen data being compromised in
different countries," Bunker said.
Out-of-date systems are
often the problem. Some governments may have used private companies to manage
the data they collected before the array of hacks and breeches brought their
attention to cybersecurity.
"In many cases, our
data was sent to third-party contractors years ago," Levin said. "The
way we looked at data management 10 years ago seems antiquated today, yet that
old data is still out there being managed by third parties, using legacy
systems."
If the "old data"
hasn't changed, it's still valuable to hackers.
The Bulgaria incident is
concerning, said Desislava Krusteva, a Bulgarian privacy and data protection
lawyer who advises some of the world's biggest tech companies on how to keep
their clients' information safe.
"These kinds of
incidents should not happen in a state institution. It seems like it didn't
require huge efforts, and it's probably the personal data of almost all
Bulgarian citizens," said Krusteva, a partner at Dimitrov, Petrov &
Co., a law firm in Sofia.
The Bulgarian Commission
for Personal Data Protection has said it would launch an investigation into the
hack.
A National Revenue Agency
spokesman would not comment on whether the data was properly protected.
"As there is
undergoing investigation, we couldn't provide more details about reasons behind
the hack," Communications Director Rossen Bachvarov said.
'Very embarrassing for the government'
A 20-year-old cybersecurity
worker has been arrested by the Bulgarian police in connection with the hack.
The computer and software used in the attack led police to the suspect,
according to the Sofia prosecutor's office.
The man has been detained,
and the police seized his equipment, including mobile phones, computers and
drives, the prosecutor's office said in a statement. If convicted, he could
spend as long as eight years in prison.
"It's still too early
to say what exactly happened, but from political perspective, it is, of course,
very embarrassing for the government," Krusteva said.
The embarrassment is made
worse by the fact that this was not the first time the Bulgarian government was
targeted. The country's Commercial Registry was brought down less than a year
ago by an attack.
"So, at least for a
year, the Bulgarian society, politicians, those who are in charge of the
country, they knew quite well about the serious cybersecurity problems in the
government infrastructures," Genov said, "and they didn't do anything
about it."
Comments
Post a Comment