Situation Summary
Bulgaria faces a coordinated nationwide security disruption following a wave of anonymous bomb threats delivered via email to state institutions, courthouses, and public administration buildings on July 11, 2026. Police have confirmed no explosive devices were discovered during mandatory evacuations and security sweeps across at least 20 cities, and all alerts have been assessed as hoaxes. The incidents represent a significant but contained disruption to judicial and administrative services with no physical harm reported. The underlying motivation—whether protest, institutional stress-testing, or threat-actor reconnaissance—remains undetermined.
Key Developments
- Nationwide courthouse and state institution threats (July 11, 2026)
Coordinated anonymous bomb-threat emails targeted courthouses and public buildings across Bulgaria, including Sofia Region prosecutor's offices, prompting mandatory evacuations in Burgas, Yambol, Razgrad, Stara Zagora, Smolyan, Targovishte, Varna, Dobrich, Silistra, Veliko Tarnovo, Blagoevgrad, Lovech, Pazardzhik, Vidin, Haskovo, Kardzhali, Shumen, Pleven, Montana, and Gabrovo.
- Sofia Region prosecutor's offices (July 11, 2026)
Seven prosecutor's offices in Sofia Region received anonymous bomb-threat emails; the Interior Ministry's regional directorate confirmed no suspicious objects were found and normal operations resumed after security checks.
- Judicial sector disruptions (July 11, 2026)
Court hearings across provincial cities were delayed or postponed as bomb squads and security teams conducted mandatory sweeps of court buildings nationwide.
- Public administration buildings targeted (July 11, 2026)
Beyond the judiciary, public administration offices were evacuated and access temporarily suspended as a precaution following similar emailed threats.
- All-clear confirmation (July 11, 2026)
Bulgarian police confirmed that no explosive devices or suspicious objects were recovered from any location and that work resumed at all affected institutions after thorough checks.
- Second consecutive day of threats (July 11, 2026)
Media reporting characterized the incidents as a "new wave" of threats, suggesting this may represent a continuation or escalation of disruption activity.
Highest-Risk Areas
Sofia-City and Gabrovo rank as Bulgaria's highest-risk sub-national zones (composite score 31.5 each), driven primarily by the concentration of state institutions, judicial infrastructure, and administrative centers in Sofia and by the nationwide scope of today's threat wave. Remaining tracked regions show substantially lower risk scores (1.5 each), reflecting the diffuse nature of the threats and the absence of sustained violence, property damage, or armed activity. The concentration of judicial and administrative targets suggests that institutional security posture and incident-response readiness, rather than broader civil instability, currently define Bulgaria's risk profile.
How GeoBit Would Assist
Security teams should deploy Intel Sweep and multi-language OSINT feeds to monitor email threat sources, actor attribution, and claim analysis; entity extraction and network analysis to map threat-sender patterns and identify potential copycat activity; and AOI Monitoring and Early Warning to track Sofia-City, Gabrovo, and secondary judicial centers for renewed threats or escalation. Sentiment and temporal analysis of social media and Telegram can detect shifts in narrative that may signal intent beyond hoaxes, enabling early protective action for personnel and assets.
7-Day Outlook
The hoax-threat wave is likely to subside in the immediate term as security protocols normalize and investigative focus intensifies. However, institutional disruptions may recur if threat actors perceive reputational or operational success; sustained monitoring of anonymous email channels and public-sector communication forums is warranted. No indicators currently suggest a shift toward physical violence or broader instability, but duty-of-care teams should maintain elevated alertness for court-related appointments and public-sector facility visits in Sofia and Gabrovo through mid-week.
Highest-Risk Areas — Ranked
| # | State / Region | Risk |
|---|---|---|
| 1 | Sofia-City | 31.5 |
| 2 | Gabrovo | 31.5 |
| 3 | Yambol | 1.5 |
| 4 | Kardzhali | 1.5 |
| 5 | Haskovo | 1.5 |
| 6 | Burgas | 1.5 |
| 7 | Vidin | 1.5 |
| 8 | Pernik | 1.5 |
| 9 | Kyustendil | 1.5 |
| 10 | Montana | 1.5 |
| 11 | Vratsa | 1.5 |
| 12 | Pleven | 1.5 |
Sources
Previous Daily Briefs
A new Bulgaria brief is written every day — each with its own risk map and downloadable CSV. Here's the last week; use the calendar to go further back.
📅 Browse every day by calendar →
Highlighted days have a brief. Tap a day for that day's map & analysis, or “csv” for that day's dataset ($5).
Atlas — our AI intelligence desk — emails them this snapshot personally. Nothing else, no list.