Claim: Actor offers 32GB of Estonian tax authority data
A threat actor claims to have stolen about 98,800 files (32GB) from the Estonian Tax and Customs Board (EMTA) and is offering the set on a dark web forum. The package would include some 16,500 personal data records and documents described as secret state procedures, service weapons and national defense material.
What happened
A threat actor on a dark web forum claims to have stolen about 98,800 files (32GB) from the Estonian Tax and Customs Board (EMTA). The package would include personal data of about 16,500 people and documents described as secret state material on service weapons and national defense. The claim has not been independently verified.
Why it matters
If authentic, according to the source, the defense and weapons material would make this far more serious than a typical personal data leak. GDPR notification duties would apply, with regulatory and public trust risk. Nothing has been confirmed so far.
What to do
Treat as an unverified claim. Monitor EMTA official channels and the press for confirmation. If the company has a relationship with EMTA, map which of its own data flows through the agency.
For the technical team
- Affected
- EMTA (Maksu- ja Tolliamet) Conselho de Impostos e Alfândega da Estônia (EMTA); conjunto alegado de cerca de 98,8 mil arquivos (32 GB), incluindo ~1 · EMTA (Maksu- ja Tolliamet), Estonian Tax and Customs Board. Alleged set: about 98,800 files (32GB), about 16,500 personal data records, employee CVs, documents described as secret state procedures (service weapons, national defense) and cyber, customs and ministry documents, including signed orders and licences.
- Exploitation
- No technical exploitation reported. Sale offer on an underground forum reported by DailyDarkWeb (X). The post shows no data samples in the screenshot and the full source is subscribers-only. Unverified claim.
- Fix
- Not applicable: alleged data leak, no product flaw.
- More details
- Source analyst note: threat-actor claim, not confirmation of a breach; the post lists file counts and categories but shows no data samples. If authentic, the defense- and weapons-related material would make this far more serious than a typical PII leak and GDPR notification duties would apply. Document contents: secret state procedures, service weapons, national defense, cyber, customs, ministry documents, signed orders, licences and employee CVs.
Timeline
X post reports the offer of 32GB attributed to the EMTA on a dark web forum.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
