Bulgaria

Situation Summary

Bulgaria's composite threat score remains low (7/167 globally), but a coordinated nationwide bomb-threat campaign on October 5 exposed critical vulnerabilities in public infrastructure and institutional security. The past week saw escalating civil unrest (protests, vigilante action, inter-personal violence) concentrated in Sofia-City and coastal cities, followed by a sudden shift to coordinated infrastructure disruption. The trajectory suggests either copycat activity or organized intent to test emergency-response protocols across multiple jurisdictions.

Key Developments

• October 5 — Nationwide bomb-threat campaign: Coordinated emailed threats targeted courts, municipal and regional administrations, schools, kindergartens, hospitals, and other public institutions across at least 15 cities including Sofia, Plovdiv, Burgas, Varna, Razgrad, Shumen, Lovech, Dobrich, Kyustendil, Montana, Isperih, Haskovo, Vidin, Kazanlak, and Dupnitsa. All facilities were evacuated and searched; no explosives were found. Police opened an investigation into the source and motive.

• October 5 — Burgas Courthouse evacuation: The courthouse closed to staff and public from approximately 09:15–11:00 following a bomb threat; no device was located after police inspection.

• October 5 — Razgrad and Isperih incidents: Threats affected Razgrad District Court, Razgrad District Prosecutor's Office, Kindergarten No. 6 in Razgrad, and Isperih Hospital. All were evacuated and checked; no explosives confirmed.

• October 5 — Lovech and Shumen disruptions: Threats were sent to Lovech Regional Administration, Lovech Municipality, Preslav residential-care facility, Shumen Municipality, Ivanski kindergarten, and a Shumen drama-and-puppet theater. Staff evacuations and police searches yielded no devices.

• September 28 — Sofia courthouse protest: Demonstrators gathered outside Sofia Courthouse under the banner "No to vandalism," demanding investigation into deaths near Petrohan Hut and other locations.

• September 28 — Presidential protest planned: Organizers scheduled a politically charged "Down with Yotova!" protest for 18:30 outside the Presidential Palace, claiming approximately 5,000 expected participants.

• September 27 — National Theater disruption: A protest outside the National Theater disrupted a Sunday dance event following a dispute over loud music and alleged interference with a theatrical performance.

• September 27 — Street violence: A fight outside an establishment involving four men resulted in one hospitalization with a fractured lower leg; police opened a pre-trial proceeding.

• September 26 — Vigilante action in Burgas: Approximately 100 aggressive people gathered outside a food shop in preparation for a vigilante attack; police and gendarmerie intervened and dispersed the group.

• September 26 — Police pursuit near Pomorie: Two men from Burgas's Rudnik neighborhood refused a police stop near Pomorie, triggering a 35-kilometer pursuit before apprehension.

Highest-Risk Areas

Sofia-City (risk 72), Plovdiv (68), and Varna (65) account for the top three sub-national threat concentrations and reflect both institutional density and historical patterns of civil unrest. Coastal and major urban centers—Burgas (62), Ruse (55)—show elevated risk driven by organized petty crime, vigilante action, and inter-personal violence. The October 5 bomb-threat distribution indicates that threat actors are targeting administrative hubs and childcare facilities nationwide, raising risk across smaller jurisdictions (Razgrad, Shumen, Dobrich, Lovech) that typically score lower.

How GeoBit Would Assist

Security teams should deploy AOI Monitoring & Early Warning on Sofia-City, Plovdiv, and coastal municipalities to detect protest mobilization, vigilante gathering, and infrastructure threats in real time. Intel Sweep and multi-language OSINT fusion across Bulgarian news, Telegram, and email-intercept contexts would establish patterns in threat communications and identify organized actors behind the October 5 campaign. Network & Actor Analysis combined with Shodan (institutional IT/building-automation exposure) would map institutional vulnerabilities and correlate them with threat targeting.

7-Day Outlook

The October 5 bomb-threat campaign is likely to trigger heightened security measures at courts and government buildings nationwide, with sustained police investigation expected. Civil unrest (protests, vigilante action) will probable persist in Sofia and major cities over the near term if underlying political grievances remain unresolved. Duty-of-care teams should anticipate temporary facility closures, delayed administrative processes, and intermittent transport disruptions in high-risk zones through mid-October.

Highest-Risk Areas — Ranked

Previous Weekly Briefs

A new Bulgaria brief is written every Monday, covering the week — each with its own risk map and downloadable CSV. Use the calendar to go further back.

• September 28, 2026⬇ CSV · $5
• September 21, 2026⬇ CSV · $5
• September 14, 2026⬇ CSV · $5
• September 7, 2026⬇ CSV · $5
• August 31, 2026⬇ CSV · $5
• August 29, 2026⬇ CSV · $5
• August 26, 2026⬇ CSV · $5