A 20-year-old Bulgarian cybersecurity worker has been arrested on suspicion of involvement in a hacking attack that stole millions of taxpayers' personal and financial data, officials said on Wednesday.