Full Report
An unidentified group set fire to Starlink satellite communications antennas in Bulgaria. Ivaylo Mirchev, a local lawmaker from the Yes, Bulgaria! party, was…
Analysis Summary
# Incident Report: Arson Attack on Starlink Ground Station (Bulgaria)
## Executive Summary
An unidentified group committed physical sabotage by setting fire to the "Plana" Starlink ground station near Sofia, Bulgaria. The attack resulted in the destruction of 11 out of 17 satellite antennas, significantly impacting a critical communications link used by both civilian networks and the Ukrainian military. While investigations are ongoing, the incident follows a pattern of similar attacks against Starlink infrastructure in Europe, with suspected links to state-sponsored sabotage.
## Incident Details
- **Discovery Date:** October 12, 2026
- **Incident Date:** Circa early October 2026 (Reported October 12)
- **Affected Organization:** Starlink (Infrastructure provider); Plana Earth Station
- **Sector:** Telecommunications / Critical Infrastructure
- **Geography:** Plana, near Sofia, Bulgaria
## Timeline of Events
### Initial Access
- **Date/Time:** Early October 2026 (exact time undisclosed).
- **Vector:** Physical Perimeter Breach.
- **Details:** Two unidentified individuals gained physical entry to the facility grounds. According to the State Agency for National Security, security fencing had been partially removed to accommodate planned site expansions, creating a vulnerability.
### Lateral Movement
- **Details:** Not applicable (Physical attack). The perpetrators moved across the facility grounds to target specific hardware clusters.
### Data Exfiltration/Impact
- **Details:** 11 of the 17 Starlink satellite antennas were damaged or destroyed by fire. This resulted in the degradation of the terrestrial-to-satellite internet link.
### Detection & Response
- **Discovery:** Detected via onsite surveillance footage and discovery of the fire/damage.
- **Response actions:** Local law enforcement and the State Agency for National Security launched an investigation. The incident was escalated to the Bulgarian Parliament for a hearing on October 14, 2026.
## Attack Methodology
- **Initial Access:** Physical Trespass (exploiting construction/expansion vulnerabilities).
- **Persistence:** N/A (Hit-and-run sabotage).
- **Privilege Escalation:** N/A.
- **Defense Evasion:** Conducted at a "secret facility" during a period of reduced physical security.
- **Credential Access:** N/A.
- **Discovery:** Target identified likely due to its strategic importance to Ukrainian military communications.
- **Lateral Movement:** N/A.
- **Collection:** N/A.
- **Exfiltration:** N/A.
- **Impact:** Physical Arson/Incendiary sabotage.
## Impact Assessment
- **Financial:** Significant hardware replacement costs for 11 satellite antennas and associated cabling.
- **Data Breach:** None.
- **Operational:** Disruption of high-speed satellite internet transit. Specifically impacts the "main communications link" for regional satellites.
- **Reputational:** High; highlights vulnerabilities in critical infrastructure supporting the Ukrainian war effort.
## Indicators of Compromise
- **Network indicators:** N/A.
- **File indicators:** N/A.
- **Behavioral indicators:**
- Physical presence of two unauthorized individuals on surveillance footage at the Plana Earth Station.
- Use of accelerants to target satellite dish arrays.
- Pattern matching a previous arson attack in Poland (September 2026).
## Response Actions
- **Containment:** Fire was extinguished; remaining 6 antennas were secured.
- **Eradication:** Investigation into the two suspects; review of security footage.
- **Recovery:** Bulgarian authorities confirmed an ongoing investigation; facility expansion continues with likely increased security presence.
## Lessons Learned
- **Key takeaways:** Physical security is as critical as cybersecurity for distributed networks like Starlink. Temporary removal of fencing for construction purposes created a high-risk window that was exploited.
- **What could have been done better:** The facility should have implemented temporary mobile security patrols or motion-sensing alarms in areas where the perimeter fence was compromised.
## Recommendations
- **Perimeter Integrity:** Ensure all critical infrastructure sites maintain a 24/7 closed perimeter, even during construction phases.
- **Surveillance Integration:** Deploy AI-based thermal or motion detection cameras that trigger real-time alerts to security personnel when human activity is detected near sensitive hardware.
- **Strategic Hardening:** Increase physical security for Starlink ground stations across Europe, as they have clearly been identified as high-value targets for sabotage.