site.btaMedia Reports Massive Personal Data Leak from Insurer, It Denies, Blames Smear Campaign

Media outlets reported Wednesday a massive leak of personal data from Lev Ins insurer, affecting over 2 million clients of the company. Approached by BTA, Lev Ins denied any leak and blamed a smear campaign.

According to Capital and Dnevnik , the Lev Ins system was breached by a hacker under the pseudonym "Emil Kyulev" and they accessed the personal data of 2.25 million people and emailed it to the media. The leaked data allegedly contains names, ID numbers, ID card numbers and addresses of former and current clients of the insurer, including former Prosecutor General Ivan Geshev and acting Prosecutor General Borislav Sarafov, Capital pointed out.

According to Capital, Lev Ins is the largest insurance company in Bulgaria by annual premium income.

Capital contacted the hacker and were told that the breach took place in December 2022 and required only basic skills although Lev Ins offers its clients insurance and monitoring against cyberattacks. 

He also told the media outlets that the hack was aimed against Lev Ins and personally against Alexey Petrov, who is believed to be the real owner of the insurance company even though he has no official position in it.

The leak has not been reported by Lev Ins to the Commission for Personal Data Protection, the news media report.

Lev Ins spokesperson Irena Tomcheva told BTA: "No personal data of our customers has been leaked. We know who stands behind the pseudonym 'Emil Kyulev' and we have taken all necessary measures."

The company is also quoted by the BIRD.BG investigative journalists as saying that the personal data sent to the news media has data about many centenarians and very young children, and those can't be Lev Ins clients. It is also quoted as saying that the personal data in question has long circulated on Internet.