The 2019 Bulgarian tax authority hack has taught us two things:

First, tax authorities are probably already collecting a lot more data than they tell us and than we think.

After the hack in Bulgaria 57 databases with 10.7 GB of data were shared in a forum. The hacker claimer that 110 databases with nearly 21 GB were stolen. The data contains names, personal identification numbers, home addresses, financial earnings, debt information, health and pension payments and so on of 5 million Bulgarians (out of 7 million, i.e. just about every working adult) ranging from 2007 to June 2019. The data also contains information imported to the tax authority’s systems from many other government agencies such as customs agency (BECIS system), Department Civil Registration and Administrative Services (GRAO), National Health Insurance Fund (NZOK) and Bulgarian Employment agency (AZ).
But most interestingly, officials said that this is only 3% of the data they have!

Second, the authorities don’t seem to have understood the real value / damage potential of this data yet and fail to secure it accordingly.

The hacker seemed to use SQL injection to gain access to the databases through a rarely used VAT refund service for transactions abroad. This VAT refund service was implemented in 2012, but not updated since. Since SQL injection is no rocket science, this leaves the impression of poorly secured and protected data.
Since 2002, the Bulgarian government has spent estimated more than $1 billion (about 2 billion BGN) on e-government projects. At the same time, a 2018 annual report on the state of national security already indicated a very low level of cybersecurity insufficient to counter modern challenges, but obviously no adequate action was taken.

The rise of VAT and the impact of digitalisation

The rise of value-added tax (VAT) in the last decades is stunning.

Source: OECD (2018), Revenue Statistics 1965 – 2017, p. 29

I ask myself what the long-term impact of digitalisation will be. My guess would be that it becomes even more important and its share of total tax revenue further increases. On the one hand, VAT can easily be extended to the sale of digital products and services. On the other hand, I observe that tax administrations unroll digital technology first and massively in the area of VAT (it’s less complicated than corporate tax, for example). This makes control cheap and efficient, especially in the area of digital services, and will help a lot improving taxpayer compliance and increasing revenue.