The National Revenue Agency did not take enough measures to protect the personal data it held, the Chairman of the Commission for Personal Data Protection Ventsislav Karadjov said in his report to the National Assembly ad-hoc committee which was summoned to conduct an inquiry into all facts and circumstances surrounding the hacker attack against the servers of the revenue agency. Personal data of over 5 million people was stolen after the hacker attack against NRA in July this year. That is why the Commission for Personal Data Protection fined the National Revenue Agency with EUR 2.5 million. The revenue agency appealed this fine in court. After the leak of personal data, Germany and Singapore temporarily suspended part of the automatic exchange of data with Bulgaria.