Generali Insurance Bulgaria Dataset Claim Covers 1,241,432 Personal Records
A forum actor posting as Intelligence is offering what they claim is a dataset containing 1,241,432 personal-data records belonging to customers of Generali Insurance Bulgaria (Generali Insurance AD), a licensed Bulgarian insurer that operates as part of the global Assicurazioni Generali group. The actor states that the material was taken from gi-webserver.generali.bg/InsurerWeb and that the advertised records do not represent the entire database. The listing describes policy, customer, insured-person, authorized-person, lessee and vehicle information, including Bulgarian EGN/EIK identifiers, names, addresses, phone numbers, email addresses, dates of birth, policy details and vehicle identifiers. The actor claims the data is fresh, untouched and will be sold to only three buyers. The claim is unverified.
▣Post details
!What the post claims
- 1,241,432 personal-data records
- Dataset is not the entire database
- Claimed breach date: Apr 28, 2026
- Policy IDs, types and numbers
- Policy start, end and conclusion dates
- Agent and issuer information
- Owner EGN/EIK identifiers
- Owner names or company names
- Owner addresses, phone numbers and emails
- Insured-person EGN/EIK identifiers
- Insured-person names and dates of birth
- Country, region and city information
- Authorized-person identity and contact fields
- Lessee identity and contact fields
- Vehicle registration and VIN-related fields
- Engine power, displacement and type
- Vehicle color, weight and payload
- Year of manufacture and first registration
- Raw files allegedly available
- Associated tools allegedly available
- Actor claims data is untouched and fresh
- Sale limited to three buyers
◱Screenshot
☷Mapped techniques
The listing does not describe the initial intrusion method. The entry below is inferred from the actor's claim that structured insurance records were dumped from an internal web application.
- Collection T1213 Data from Information Repositories Inferred The claimed dataset contains structured policy, customer, insured-person, lessee and vehicle records and is described as having been dumped from the insurer's InsurerWeb system.
⚠Potential impact
If authentic, the dataset could expose a large population to identity theft, targeted phishing, insurance fraud and highly convincing impersonation attempts. Bulgarian EGN/EIK identifiers, when combined with names, birth dates, addresses and contact details, create a particularly sensitive identity profile. Policy and vehicle information can add context that makes fraud attempts more believable, while VIN, registration and insurance details may support scams aimed at vehicle owners, insurers or financial institutions. The actor's stated plan to sell the data to only a small number of buyers may limit immediate distribution, but it does not reduce the sensitivity of the records themselves.
iStatus Unverified
The forum post provides a specific record count, a claimed breach date, an alleged source application and an extensive list of columns. The actor also states that the advertised material is only part of the full database and that raw files and related tools are available. However, the listing does not explain how the environment was accessed, how long access persisted or whether the underlying weakness has been remediated. Dark Web Informer has not independently verified the dataset, the claimed record count or the actor's description of its source.
Dark Web Informer // Threat Intelligence
