Situation Summary
Bulgaria is experiencing a sustained nationwide security alert driven by coordinated bomb threats targeting government and judicial infrastructure. Over the past 48 hours, courthouses, ministries, and public buildings have received multiple email threats, prompting evacuations and police response across the country. The threat pattern shows no geographic containment and reflects broader instability; regional risk concentration in Shumen (31.3) and Haskovo (18.1) suggests localized vulnerabilities alongside the national campaign. The trajectory remains elevated pending threat clarification and law-enforcement response.
Key Developments
- Nationwide (Courthouses & Public Buildings) — 2026-07-28 — Police and court officials confirmed receipt of email bomb threats at courthouses and public buildings across Bulgaria, triggering security evacuations and ongoing police investigations.
- Nationwide (Ministries & Government Buildings) — 2026-07-28 — Radio Bulgaria reported a third consecutive day of bomb threats affecting ministries and government buildings, with multiple facility evacuations and continued alert status.
- Regional Concentration — Shumen & Haskovo — Shumen (risk score 31.3) and Haskovo (18.1) remain the highest-risk provinces; no confirmed incidents reported in these areas in the past 48 hours, but elevated baseline scores warrant heightened monitoring of critical infrastructure.
- Sofia-City Secondary Alert — 2026-07-26–28 — National Assembly and government statements reflect coordination among senior officials in response to the broader threat campaign; Sofia-City risk score of 6.1 indicates moderate exposure despite capital status.
- Cross-Border Signals — 2026-07-26–28 — Public statements and diplomatic activity involving Romania and Iran signals potential external dimensions to the current environment, though direct causal links to domestic bomb threats remain unconfirmed.
Highest-Risk Areas
Shumen province dominates the national risk profile (31.3), more than 1.7 times higher than Haskovo (18.1), the second-ranked region. The concentration in these northeastern and south-central areas suggests either sustained local instability, criminal or protest activity, or organizational vulnerabilities in public-security response. Sofia-City, despite its administrative centrality, ranks third (6.1) and has absorbed the immediate bomb-threat activity; the gap between Shumen's baseline and current incident reporting warrants field verification to determine whether Shumen faces unreported incidents or represents a structural (rather than event-driven) risk. Varna and other coastal/southern regions show minimal scores (1.3–3.7), indicating lower near-term exposure for corporate assets in those areas.
How GeoBit Would Assist
Security teams operating in Bulgaria should deploy AOI Monitoring & Early Warning on government buildings and critical infrastructure in Shumen, Haskovo, and Sofia to detect pattern changes or escalation. Intel Sweep and multi-language OSINT (email threat analysis, Telegram/X monitoring, local radio feeds) will enable real-time correlation of threat claims, attribution signals, and law-enforcement posture. Risk & Threat Assessment combined with Entity Extraction across government statements and media will clarify whether threats are domestic (protest/criminal), external, or hoax-based—critical for duty-of-care decisions on movement, facility access, and personnel posture.
7-Day Outlook
The bomb-threat campaign is likely to persist for 3–7 days pending police de-escalation or arrest. If threats cease and are attributed to a discrete actor or network, risk will contract rapidly; if they broaden to private sector or transport infrastructure, nationwide alert levels will remain elevated. Corporate teams should expect continued government building closures and periodic evacuations, with secondary impacts on supply-chain and meeting logistics.
Highest-Risk Areas — Ranked
| # | State / Region | Risk |
|---|---|---|
| 1 | Shumen | 31.3 |
| 2 | Haskovo | 18.1 |
| 3 | Sofia-City | 6.1 |
| 4 | Dobrich | 6.1 |
| 5 | Varna | 3.7 |
| 6 | Yambol | 1.3 |
| 7 | Kardzhali | 1.3 |
| 8 | Burgas | 1.3 |
| 9 | Vidin | 1.3 |
| 10 | Pernik | 1.3 |
| 11 | Kyustendil | 1.3 |
| 12 | Montana | 1.3 |
Sources
Previous Daily Briefs
A new Bulgaria brief is written every day — each with its own risk map and downloadable CSV. Here's the last week; use the calendar to go further back.
📅 Browse every day by calendar →
Highlighted days have a brief. Tap a day for that day's map & analysis, or “csv” for that day's dataset ($5).
Atlas — our AI intelligence desk — emails them this snapshot personally. Nothing else, no list.