3.1 Million DZI Records Offered With National ID and Passport Numbers
A forum actor posting as Intelligence is selling what they describe as 3,134,269 full personal data records belonging to customers of DZI Insurance, Bulgaria's oldest insurer and a subsidiary of Belgium's KBC Group. The stated column list is unusually complete for an identity set: national identity number, date of birth, passport number with its issue date and issuing authority, full names in both Cyrillic and Latin script, full postal address, email, up to two phone numbers, nationality and a foreign resident flag. The actor dates the breach to 21 May 2026, attributes it to a poorly secured API on the customer portal, and says the set will be sold to only two buyers, with more to follow. The claim is unverified.
▣Post details
!What the post claims
- 3,134,269 records
- Breach dated 21 May 2026
- Poorly secured API cited
- Customer portal named
- Raw JSON files available
- National identity numbers
- Dates of birth
- Passport numbers
- Passport issue dates
- Passport issuing authority
- Names in Cyrillic and Latin
- Full postal addresses
- Email addresses
- Up to two phone numbers
- SMS contact flags
- Nationality and residency flags
- Individual or company flag
- Further releases promised
◱Screenshot
☷Mapped techniques
Mapped from the actor's own account. Claimed, not confirmed.
- Initial access T1190 Exploit public facing application Stated The actor attributes the extraction to an inadequately protected interface on the customer facing portal. No endpoint or flaw is described.
- Collection T1213 Data from information repositories Stated Raw JSON is offered alongside the tabular set, consistent with records pulled through an interface at volume rather than a database backup.
- Exfiltration T1567 Exfiltration over web service Inferred The sample is posted inline and the sale is handled privately. The route out of the environment is not described.
⚠Potential impact
The national identity number is the identifier Bulgarian banking, healthcare and government all rely on, it encodes date of birth and sex, and it is not something a citizen can change. Paired with a passport number, its issuing authority and a residential address, each record is a complete and permanent identity kit rather than a contact detail. At over three million records the set reaches a substantial share of the adult population, which makes the useful question not who is affected but which institutions still accept an identity number and a name as proof of identity. The two buyer model cuts against wide circulation but points toward deliberate exploitation by a small number of hands.
iStatus Unverified
The sample runs long and holds together, with Cyrillic and Latin transliterations that correspond, plausible identifier formats and real Bulgarian localities, which is laborious to fabricate at that length. Against that, the account is brand new with a single post and no standing, no price is published, and the limited sale plus promise of more is a familiar sales device. One detail deserves attention: the breach is dated 21 May, more than three months before this listing, with no public notification apparent since, which in an EU jurisdiction is its own question. Dark Web Informer has not retrieved the data and is not linking it, and neither DZI nor its parent has publicly addressed the claim.
Dark Web Informer // Threat Intelligence
