Situation Summary
Bulgaria faces an ongoing campaign of coordinated bomb threats targeting judicial and state administrative infrastructure nationwide. Over 2–9 July 2026, state institutions across at least 20 cities—including courthouses, prosecutor's offices, and public buildings—received anonymous mass emails threatening explosions. All searches have returned negative for explosive devices, but the campaign is disrupting judicial operations, delaying hearings, and forcing repeated evacuations. The threat appears coordinated, sustained, and deliberately targeting institutional functionality rather than posing verified explosive risk.
Key Developments
- Nationwide courthouse and prosecutor-office threats, 8–9 July 2026:
Anonymous bomb-threat emails were sent to courthouses and prosecutor's offices across Bulgaria, including Sofia Region, Burgas, Varna, Plovdiv, Yambol, Razgrad, Stara Zagora, Smolyan, Targovishte, Dobrich, Silistra, Veliko Tarnovo, Blagoevgrad, Lovech, Pazardzhik, Vidin, Haskovo, Kardzhali, Shumen, Pleven, Montana, and Gabrovo. Authorities evacuated buildings and conducted security sweeps; no explosive devices were found at any location.
- Sofia Region prosecutor's offices targeted, 8–9 July 2026:
Seven prosecutor's offices in the Sofia Regional Directorate received threatening emails on 8–9 July, prompting heightened security and building inspections. Operations resumed after all-clear checks.
- Second consecutive day of coordinated disruption, 8–9 July 2026:
This marks the second day of a nationwide coordinated threat campaign, indicating sustained intent to disrupt state institutions and judicial function rather than isolated incidents.
- Operational impact on judicial system:
Court hearings have been postponed and administrative services delayed as a result of mandatory evacuations and security protocols.
- Mass-email distribution methodology:
Threats are being delivered via anonymous mass email to state institutions, suggesting organized infrastructure and coordination across multiple geographic targets.
Highest-Risk Areas
Gabrovo province shows markedly elevated composite risk (31.5), substantially higher than all other regions. Sofia-City follows at 2.3, with Yambol, Kardzhali, Haskovo, Burgas, Vidin, Pernik, Kyustendil, Montana, Vratsa, and Pleven each at 1.5. The disparity reflects Gabrovo's inclusion in the current bomb-threat campaign and suggests either underlying institutional vulnerability, prior security incidents, or localized instability factors. Sofia-City's elevated secondary risk reflects its status as the capital and concentration of government, judicial, and administrative infrastructure—a natural targeting priority for coordinated threat campaigns. All other provinces show baseline or near-baseline risk; the nationwide email campaign has not yet generated measurable elevation in non-Gabrovo/Sofia-City regions.
How GeoBit Would Assist
Security and duty-of-care teams should deploy AOI Monitoring & Early Warning on key judicial and administrative buildings in high-risk provinces (particularly Gabrovo and Sofia), combined with multi-language OSINT (X/Twitter, Telegram, local media) fusion to detect threat communications, claimed responsibility, or related chatter before impact. Entity extraction and network analysis capabilities would identify patterns in email metadata, claimed motivations, or actor networks behind the coordinated campaign. Intel Sweep and event-feed integration provide real-time alerts on new threats, evacuations, or security incidents affecting specific facilities or cities where personnel or assets are deployed.
7-Day Outlook
The threat campaign is likely to persist or escalate over the next 7 days absent law-enforcement breakthrough in identifying the threat source or actor motivation. Continued coordinated targeting of judicial infrastructure should be anticipated, with intermittent disruptions and evacuations likely in Sofia, Gabrovo, and other major cities. Organizations with personnel in courthouses, prosecutor's offices, or public administrative buildings should maintain elevated alert posture and pre-planned evacuation protocols.
Highest-Risk Areas — Ranked
| # | State / Region | Risk |
|---|---|---|
| 1 | Gabrovo | 31.5 |
| 2 | Sofia-City | 2.3 |
| 3 | Yambol | 1.5 |
| 4 | Kardzhali | 1.5 |
| 5 | Haskovo | 1.5 |
| 6 | Burgas | 1.5 |
| 7 | Vidin | 1.5 |
| 8 | Pernik | 1.5 |
| 9 | Kyustendil | 1.5 |
| 10 | Montana | 1.5 |
| 11 | Vratsa | 1.5 |
| 12 | Pleven | 1.5 |
Sources
Previous Daily Briefs
A new Bulgaria brief is written every day — each with its own risk map and downloadable CSV. Here's the last week; use the calendar to go further back.
📅 Browse every day by calendar →
Highlighted days have a brief. Tap a day for that day's map & analysis, or “csv” for that day's dataset ($5).
Atlas — our AI intelligence desk — emails them this snapshot personally. Nothing else, no list.