Situation Summary
Bulgaria remains a low-intensity threat environment at global rank #102 (composite score 10), with 26 tracked events. However, sub-national risk is highly concentrated: Gabrovo district presents significantly elevated threat (31.4), and Sofia-City (20.8) accounts for the majority of recorded activity, while remaining provinces cluster at baseline (1.4–2.5). No active conflict, large-scale civil unrest, or terrorism campaigns are evident; the threat landscape is fragmented and localized.
Key Developments
- 26 June 2026 · Cyber / Law Enforcement – U.S. DOJ Domain Seizure · Bulgarian hosting infrastructure was among servers targeted in a transnational operation by the U.S. Department of Justice to dismantle ~400 internet domains used for illegal World Cup streaming. Specific cities within Bulgaria not identified; this is a cyber/IP-enforcement action, not a physical security incident, but confirms use of Bulgarian infrastructure in international criminal networks. No direct impact on travel or on-ground safety reported.
Beyond this single confirmed development dated within 48 hours, web and social-media searches do not yield additional Bulgaria-specific security events with reliable confirmation and clear dating. Broader regional developments (Bangladesh military mobilization, tribunal actions, displaced-person statements) are monitored but do not directly affect Bulgaria's internal security posture at present.
Highest-Risk Areas
Gabrovo (north-central Bulgaria) and Sofia-City dominate the risk profile, together accounting for over 90% of tracked threat signals. Gabrovo's elevated score (31.4) suggests concentration of specific incidents—whether organized crime, labor unrest, or localized civil disorder—requiring targeted investigation; Sofia-City (20.8) reflects capital-region exposure to government instability, protest activity, and transnational criminal networks. All other provinces remain at baseline threat (1.4–2.5), indicating either genuine low activity or sparse reporting. Corporate and duty-of-care teams with operations or personnel in Gabrovo or central Sofia should apply heightened situational awareness; the remainder of Bulgaria presents routine country-risk conditions.
How GeoBit Would Assist
Security teams monitoring Bulgaria should deploy AOI Monitoring & Early Warning on Gabrovo and Sofia-City districts to detect emerging incidents in real time and receive threshold-based alerts. Intel Sweep and multi-language OSINT (web, X/Twitter, Telegram, local Bulgarian media) provide continuous 24–48-hour event capture and sentiment analysis, preventing blind spots in reporting. Network & Actor Analysis can identify criminal syndicates, labor organizers, or protest leaders whose activity patterns correlate with elevated risk, enabling advance warning for staff movements and asset protection. Routing & Network Analysis supports contingency planning for personnel transit, particularly in or near Gabrovo and Sofia.
7-Day Outlook
No escalation of threat is anticipated over the next seven days. Baseline vigilance should continue, with particular focus on Gabrovo for any sudden incident clusters and Sofia-City for government policy announcements or protest mobilization. Unless transnational events (regional conflict, refugee flows, or economic shocks) materialize, Bulgaria's threat ranking is expected to remain stable at #102 globally.
Highest-Risk Areas — Ranked
| # | State / Region | Risk |
|---|---|---|
| 1 | Gabrovo | 31.4 |
| 2 | Sofia-City | 20.8 |
| 3 | Plovdiv | 2.5 |
| 4 | Yambol | 1.4 |
| 5 | Kardzhali | 1.4 |
| 6 | Haskovo | 1.4 |
| 7 | Burgas | 1.4 |
| 8 | Vidin | 1.4 |
| 9 | Pernik | 1.4 |
| 10 | Kyustendil | 1.4 |
| 11 | Montana | 1.4 |
| 12 | Vratsa | 1.4 |
Sources
Previous Daily Briefs
A new Bulgaria brief is written every day — each with its own risk map and downloadable CSV. Here's the last week; use the calendar to go further back.
📅 Browse every day by calendar →
Highlighted days have a brief. Tap a day for that day's map & analysis, or “csv” for that day's dataset ($5).