Disrupted online services, reports of millions of personal data records being leaked and an investigation into an alleged €6 million ransom. Several cases from the Bulgarian insurance sector have shown what kind of trouble cyberattacks can cause even to companies whose job it is to manage risk.
Euroins offers cybercrime insurance on its website. It is called “Cyber Smart“ and among the risks it covers under the agreed terms are business interruption, financial losses and cyber extortion. A completely reasonable product for a world in which hackers can cause millions in damage to a company without even setting foot in its office.
In July, however, the insurer itself had to deal with a massive cyberattack. Some of its electronic services were temporarily disrupted, and customers were instructed to use physical offices to sign up for policies, pay premiums, and file claims.
Eurohold, the Bulgarian holding group that owns Euroins, said its specialists managed to stop the attack with the assistance of the competent state authorities. The company assured that customer data remained protected, and some of the service difficulties were related to the security measures taken.
And this is the curious moment. When a company finds out that it has been attacked, its specialists sometimes have to limit access to certain systems until they clarify the extent of the attack. This means inconvenience for customers, but such measures can prevent the infection from spreading and causing much more serious damage.
A lot depends on the speed with which the threat is detected and the ability to separate infected devices from the rest of the infrastructure.
The attack against Euroins was contained, and according to the company, customer data remained protected. In the same year, however, other large insurers in Bulgaria had to deal with problems related to the security of personal information.
Millions of records and the question of who actually keeps the data
At the end of the summer, DZI customers received notifications of a personal data breach. The insurer assured that its services continue to operate normally, and subsequently launched an information campaign with advice on how people can recognize fraud attempts.
In September, the investigative journalism platform BIRD reported on two large arrays of personal information linked to DZI and Generali Insurance, part of the international insurance group Generali.
According to the investigation, one contains over 3 million records related to DZI, and the other - over 300,000, related to Generali. Among the information mentioned are names, personal identification numbers, addresses and telephone numbers.
The full volume of data has not been officially confirmed, and millions of records do not necessarily mean millions of different affected people. However, the amount of information described is large enough to raise serious questions about the way it is stored and protected.
DZI confirmed to BIRD the leak of personal information, but specified that no penetration of the company's own information systems was established. Among the possibilities being considered is that the data became available through an insurance intermediary.
The Personal Data Protection Commission also confirmed that it had received notifications of security breaches from DZI companies and Generali. Proceedings have been initiated in the cases, but in the publicly disclosed information, the regulator does not indicate final conclusions about the exact mechanism and the full scope of the incidents.
The assumption of a possible problem with an intermediary is particularly interesting if we consider how many people and companies can be involved in the conclusion of a simple insurance policy.
You may have purchased your policy through a broker, agent or online platform. For you, this is a relatively short procedure: you fill in the data, pay and receive the document. However, behind it are often several organizations that process information through different systems. Some use their own software, others rely on external technology providers.
Thus, even a large insurer with a well-protected infrastructure can find itself at risk due to a weakness in its partner's system. A vulnerability in an application that has access to customer information is enough. Whether such a problem led to the DZI case has yet to be clarified.
One way companies can detect such weaknesses in advance is through controlled penetration tests, known as Penetration Testing. Cybersecurity specialists are given permission to check how far they can penetrate certain applications, servers, and networks, using techniques similar to those of real attackers.
After the checks, the company receives a report on the vulnerabilities found and recommendations on how to fix them. Systems through which employees and external partners exchange sensitive information deserve particular attention, because access to them is often distributed among multiple users.
For the average person, the consequences of a personal data leak can be quite unpleasant. Name, personal identification number, phone number, and address give fraudsters enough details to convincingly present themselves as an employee of an insurer, bank, or government institution. The next step is usually an attempt to obtain more information or convince the victim to make a payment.
There is also one particularly annoying problem: a password can be changed in a minute, but with the EGN and other personal data, one does not have such freedom. Once in the wrong hands, they can be used in new scams long after the initial incident.
Six million euros and one offer from the hackers
In April, Mediapool and Capital published an investigation into an attack on the Bulgarian branch of the Austrian insurance group Unica. The incident itself dates back to February 2025, but the details of the alleged extortion became public later.
According to journalists, the likely perpetrator is the Akira group, an international criminal organization known for so-called ransomware attacks. The hackers use malicious software to encrypt files and databases to which their owner no longer has normal access. They can then demand a ransom in exchange for their recovery.
The signal to the two media outlets, supported by two other sources, indicates that Unica was asked for an amount of about 6 million euros. The amount of the alleged ransom has not been officially confirmed, and the journalists were unable to establish whether a payment was made.
The way in which such criminals talk to their victims is also curious. At the beginning of the investigation, Mediapool published a sample text of a cyber-extortion message:
„Don't forget that there is a price at which all this can be fixed.“
There is no evidence that this particular message was sent to Unica. But the approach is indicative: after creating a serious problem for the company, the attackers begin to behave like people with whom a business agreement can be reached. They want money, in return for which they promise to repair the damage they caused themselves.
In August 2026, Unica published an official notification with more information about the incident. The company confirmed that the cyberattack temporarily affected the accessibility and confidentiality of its databases, and the information was encrypted.
According to the insurer's assessment, the affected customers are less than 3% of its total customer base. The company reported that the systems have been restored, and at the time of the notification, no evidence of misuse of the information has been found.
Even when access to the databases is restored, such an incident can leave the company with a significant bill. Restoring the systems requires specialists, time and additional checks, and any interruption can delay service. If the attackers have also managed to copy information, the risk of subsequent misuse remains.
Cyberattacks came out on top among business risks
At the beginning of 2026, the German insurance group Allianz published curious data about Bulgaria in its annual Risk Barometer survey. The survey collects the assessments of corporate executives, risk management specialists and experts from the insurance sector.
Just a year earlier, cyber incidents were in tenth place among the mentioned business risks in our country with 12% of the responses. In 2026, they already topped the ranking with 39%, ahead of concerns about regulatory changes, natural disasters and business interruption.
Of course, there is one important caveat. The Bulgarian sample includes 33 respondents, so the result shows the attitudes of a relatively small group and does not mean that the actual number of cyberattacks has increased at the same rate.
However, the global study covers 3,338 participants from 97 countries and territories, and cyber incidents have topped the international ranking for the fifth consecutive year.
The concern is understandable. An attack can affect different parts of the business, and dealing with the consequences often takes much longer than the attack itself.
According to its official position, Euroins managed to contain the attack and protect customer information, although some of the electronic services were temporarily disrupted. DZI and Generali were subject to regulatory proceedings for breaches of personal data security, the full scope of which is still being clarified. Unica confirmed an incident with temporary encryption of databases, followed by restoration of the systems.
There are also specific regulatory requirements for large financial companies. Since 2025, the European Union has implemented the DORA regulation, which regulates the digital operational resilience of banks, insurers and other financial organizations within its scope.
Behind the complex name are relatively practical obligations. Companies must manage technological risks, check how prepared they are for attacks, report serious incidents and monitor the security of external providers on whose services they depend.
These requirements are directly relevant to the cases in Bulgaria. If a system is attacked, the company needs to know who is responsible for the response, which services are most important, and how they can continue to operate while specialists fix the problem. The same applies to data that partners and external contractors have access to.
Of course, the customer rarely cares what software his insurer uses or how many servers are behind the electronic policy. He just wants to pay his premium, file a claim, and receive the compensation he contracted for.
The problems begin when the usual service is interrupted or a warning appears that his personal information may have become accessible to strangers.
If electronic services stop, there is usually an alternative way to provide them. With personal data, it is more complicated. They can remain useful to fraudsters for years, even after all affected systems have long since been restored.
And this is probably the most unpleasant part of the whole story: a company can close the technical incident while some of its customers still have to live with the consequences.