Hundreds of bomb threats to Bulgarian institutions have been sent via compromised email accounts linked to the infrastructure of providers from Italy, Great Britain, Lebanon, Brazil and Argentina. At the moment, the perpetrators have not been identified and no arrests have been made, Interior Minister Ivan Demerdzhiev announced in parliament.
According to him, since June 2026, hundreds of threatening letters have been received to courts, universities, schools, kindergartens, airports, ports and other institutions. The content is almost identical, automated and translated into Bulgarian. The messages do not contain any specific data, but allegations of planted explosive devices and subsequent violence.
“The used email boxes were compromised by unknown persons and were illegally exploited to send the bomb threats“, the Minister of the Interior stated.Pre-trial proceedings have been initiated in the cases for submitting misleading or false distress or alarm signals. Computer intelligence methods were used in the investigation, and inquiries were sent to the providers of electronic mail services.
Anonymizing services were used
According to Demerdzhiev, various anonymizing tools were used in the communication, through which the real source of the electronic messages was concealed. Some of the providers' responses indicate that the sender cannot be identified precisely because of these services.
It was also found that part of the access to compromised email boxes and servers was offered for sale on hacker forums. A free anonymizing email service from Switzerland was also used.
Contacts with partner services have shown that during the same period dozens of institutions and organizations in Balkan and European countries were subject to similar threats by email. Bulgarian authorities assume that the perpetrators are not Bulgarian citizens, but this version has not yet been confirmed.
The investigation continues
The Ministry of Internal Affairs continues its actions to locate the senders. According to the Minister of the Interior, there is currently no effective way to block all such messages, since different compromised accounts and recipients are used in each individual case.
There is a protocol for actions in the event of bomb alerts. Until a real threat is established, institutions are checked according to the procedure provided by the services, and the sent alerts remain the subject of separate pre-trial proceedings.
Sources: bntnews.bg, mediapool.bg