> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# 3.1 Million DZI Records Offered With National ID and Passport Numbers
- URL: https://darkwebinformer.com/3-1-million-dzi-records-offered-with-national-id-and-passport-numbers/
- Published: 2026-09-03T14:48:18.000Z
- Updated: 2026-09-03T14:48:18.000Z
- Author: Dark Web Informer
- Tags: Data Breaches

Breach Report Bulgaria Insurance Price By Offer 

## 3.1 Million DZI Records Offered With National ID and Passport Numbers

A forum actor posting as **Intelligence** is selling what they describe as **3,134,269 full personal data records** belonging to customers of **DZI Insurance**, Bulgaria's oldest insurer and a subsidiary of Belgium's KBC Group. The stated column list is unusually complete for an identity set: **national identity number, date of birth, passport number with its issue date and issuing authority, full names in both Cyrillic and Latin script, full postal address, email, up to two phone numbers, nationality and a foreign resident flag**. The actor dates the breach to **21 May 2026**, attributes it to **a poorly secured API on the customer portal**, and says the set will be **sold to only two buyers**, with more to follow. The claim is **unverified**.

Severity CRITICAL 

[ ![WhiteIntel, dark web exposure monitoring](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2026/08/whiteintel_io_banner.jpg) ](https://whiteintel.io/?utm%5Fsource=darkwebinformer.com&utm%5Fmedium=referral&utm%5Fcampaign=whiteintel) 

Records3,134,269

Breach dated21 May 2026

Sales limitTwo buyers

ActorIntelligence

### ▣Post details

TargetDZI Insurance

ParentKBC Group

CountryBulgaria

SectorInsurance

ListingSelling, price on request

Volume3,134,269 records

Stated sourceCustomer portal API

ObservedSep 1, 2026

### !What the post claims

- 3,134,269 records
- Breach dated 21 May 2026
- Poorly secured API cited
- Customer portal named
- Raw JSON files available
- National identity numbers
- Dates of birth
- Passport numbers
- Passport issue dates
- Passport issuing authority
- Names in Cyrillic and Latin
- Full postal addresses
- Email addresses
- Up to two phone numbers
- SMS contact flags
- Nationality and residency flags
- Individual or company flag
- Further releases promised

### ◱Screenshot

[ ![Forum listing selling an alleged DZI Insurance database of over three million Bulgarian records, September 2026](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/97283657926359762357862938765987235.png) Screenshot 1 Redacted preview ](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/size/w1304/format/webp/2026/09/97283657926359762357862938765987235.png) 

Forum post offering DZI Insurance records for sale, observed 1 September 2026.

### ☷Mapped techniques

Mapped from the actor's own account. Claimed, not confirmed.

- Initial access [T1190](https://attack.mitre.org/techniques/T1190/) Exploit public facing application Stated The actor attributes the extraction to an inadequately protected interface on the customer facing portal. No endpoint or flaw is described.
- Collection [T1213](https://attack.mitre.org/techniques/T1213/) Data from information repositories Stated Raw JSON is offered alongside the tabular set, consistent with records pulled through an interface at volume rather than a database backup.
- Exfiltration [T1567](https://attack.mitre.org/techniques/T1567/) Exfiltration over web service Inferred The sample is posted inline and the sale is handled privately. The route out of the environment is not described.

### ⚠Potential impact

The **national identity number is the identifier Bulgarian banking, healthcare and government all rely on**, it encodes date of birth and sex, and it is not something a citizen can change. Paired with a passport number, its issuing authority and a residential address, each record is **a complete and permanent identity kit** rather than a contact detail. At over three million records the set reaches **a substantial share of the adult population**, which makes the useful question not who is affected but which institutions still accept an identity number and a name as proof of identity. The **two buyer model cuts against wide circulation** but points toward deliberate exploitation by a small number of hands.

### iStatus Unverified

The sample runs long and holds together, with **Cyrillic and Latin transliterations that correspond, plausible identifier formats and real Bulgarian localities**, which is laborious to fabricate at that length. Against that, the account is **brand new with a single post and no standing**, no price is published, and the limited sale plus promise of more is a familiar sales device. One detail deserves attention: the breach is dated **21 May, more than three months before this listing**, with no public notification apparent since, which in an EU jurisdiction is its own question. Dark Web Informer has **not retrieved the data and is not linking it**, and neither DZI nor its parent has publicly addressed the claim.

Want everything on this breach? **Paid subscribers** get the full unredacted claim details and more. After subscribing, check out the [threat feed](https://darkwebinformer.com/threat-feed/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=dzi-insurance-2026-09-01&utm%5Fcontent=threat-feed) and search there for this alert.

[View pricing →](https://darkwebinformer.com/pricing?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=dzi-insurance-2026-09-01&utm%5Fcontent=pricing-button) 

[Dark Web Informer](https://darkwebinformer.com/?utm%5Fsource=alert&utm%5Fmedium=card&utm%5Fcampaign=dzi-insurance-2026-09-01&utm%5Fcontent=footer) // Threat Intelligence