Bulgaria

Situation Summary

Bulgaria faces a compound threat picture characterized by coordinated cyber-enabled hoax attacks and maritime security degradation in its Black Sea exclusive economic zone. A nationwide wave of bomb threats targeting public institutions, courts, schools, and airports—originating from foreign sources and machine-translated into Bulgarian—produced no confirmed explosive devices but generated significant operational disruption across the country on 5–12 October. Concurrent drone strikes on foreign-flagged merchant vessels on 6 October, resulting in one sinking and one fire with 10 missing sailors, have elevated concerns over critical infrastructure vulnerability and commercial shipping safety, prompting elevated national security mobilization.

Key Developments

• Burgas Courthouse, 5 October: Evacuated 09:15–11:00 following a bomb threat; police inspection found no explosive device.

• Multiple judicial, administrative, and educational institutions nationwide, 5 October: Coordinated bomb threats were received across Sofia, Plovdiv, Varna, Burgas, Razgrad, Lovech, Shumen, and other municipalities, affecting courts, district prosecutors' offices, a hospital, a care home, kindergartens, and municipal administrations. All evacuations and searches yielded no confirmed explosives.

• Black Sea EEZ, approximately 70 nautical miles east of Byala, 6 October: Sea and aerial drones struck two foreign-flagged merchant vessels—the Togo-flagged *Alfa Watan* (sank) and the Palau-flagged *Able* (fire; 18 crew rescued). Ten sailors from *Alfa Watan* remain missing; search-and-rescue operations continued through 12 October.

• Varna, 6–7 October: Bulgarian authorities treated injured crew member and coordinated maritime emergency response from the coastal city.

• Sofia, 7 October: Bulgaria's Consultative Council on National Security convened, condemned the ship attacks, and called for investigation and enhanced maritime-security measures. The Security Council identified heightened risks to shipping and critical infrastructure and proposed expanded maritime surveillance, counter-drone systems, and military modernization.

• Sofia, 7 October: Prime Minister Rumen Radev stated no immediate direct threat to national security but indicated available evidence logically pointed toward Russia in connection with the drone strikes.

• Sofia, 8 October: Interior Minister Ivan Demerdzhiev confirmed that bomb threats originated abroad, were computer-translated into Bulgarian, and appeared coordinated; no explosive devices were found.

• Bulgaria nationwide (schools, airports, public institutions), 12 October: Interior Ministry cybercrime director reported recurring waves of email bomb threats affecting hundreds of facilities; pattern consistent with foreign-sourced cyber-enabled disinformation and disruption.

• Black Sea, 12 October: Search for 10 missing sailors from *Alfa Watan* was called off after finding no trace; maritime safety concerns remain elevated.

Highest-Risk Areas

Sofia-City (risk 72) and Plovdiv (risk 68) face the highest composite risk, driven by scale of institutional and population density, making them primary targets for coordinated threat campaigns and urban security incidents. Coastal cities—Varna (65) and Burgas (62)—are elevated by dual exposure to maritime threats (drone strikes, shipping disruption) and urban infrastructure vulnerabilities. The sub-national ranking reflects concentration of state and commercial assets in urban centers; rural areas with lower rankings experience proportionally fewer reported incidents but remain susceptible to spillover effects from coordinated national campaigns.

How GeoBit Would Assist

Security teams operating in Bulgaria should employ Intel Sweep and multi-language OSINT to track emerging bomb-threat patterns, identify coordinating actors, and detect early signals of renewed campaigns. AOI Monitoring & Early Warning services configured for critical facilities (courts, schools, ports, airports) and maritime zones would provide persistent surveillance and rapid alerting to threats. Maritime & Aviation tracking combined with Satellite & Imagery analysis would enhance visibility into Black Sea vessel movements and anomalous drone activity.

7-Day Outlook

The bomb-threat campaign is likely to continue in recurring waves given its low operational cost and high disruption yield; no credible organizational attribution has been publicly established. Maritime drone activity in the Black Sea EEZ remains an acute risk to commercial shipping and may trigger further government security responses; elevated naval awareness is expected to persist through at least mid-October.

Highest-Risk Areas — Ranked

Previous Weekly Briefs

A new Bulgaria brief is written every Monday, covering the week — each with its own risk map and downloadable CSV. Use the calendar to go further back.

• October 5, 2026⬇ CSV · $5
• September 28, 2026⬇ CSV · $5
• September 21, 2026⬇ CSV · $5
• September 14, 2026⬇ CSV · $5
• September 7, 2026⬇ CSV · $5
• August 31, 2026⬇ CSV · $5
• August 29, 2026⬇ CSV · $5