Last week Bulgaria confirmed a deliberate fire at a Starlink ground facility near Sofia, putting a spotlight on a pattern of attacks against satellite internet infrastructure now being treated as sabotage. Bulgarian authorities and opposition figures say multiple antennas were set ablaze on October 9, and investigators have detained two young men holding German passports in connection with the incident. The attack comes after a separate blaze at a Starlink terminal in Poland in late September, and officials across the region are warning of a widening campaign targeting services that have become strategically important in the war in Ukraine.
What happened in Bulgaria
Bulgarian Prime Minister Rumen Radev publicly acknowledged that a fire occurred at a privately owned Starlink site close to the capital. Opposition group Democratic Bulgaria reported that 11 of 17 antennas at the facility were deliberately set on fire on October 9; the antennas had been used to support Ukraine. Authorities have since detained two men, aged 20 and 21, both holding German passports. Bulgarian investigators have not disclosed many operational details, citing the ongoing probe, and Radev declined to provide further comment while investigations continue.
Suspicions and possible links to other attacks
Bulgarian security officials described the incident as likely sabotage. The arrests in Bulgaria followed the detention earlier this month in Germany of two suspects connected to a September 23 fire at a Starlink ground terminal south of Warsaw. Investigators are probing whether the arrests in Bulgaria and Germany are connected and whether the incidents form part of a broader sabotage network. Polish authorities suspect Russian intelligence services may have been behind the attack on the Polish facility; pro-Western Bulgarian parties likewise voiced suspicions of Russian links to the Sofia blaze.
Who the suspects are (what we know)
Local media cited by investigators report that the two men detained in Bulgaria have migrant backgrounds and entered the country from Greece through the Kulata border crossing. Reports suggest authorities are examining whether they are tied to a larger network implicated in the Poland attack. Beyond their ages and passport nationality, public details about the detainees’ identities, motives, or alleged handlers remain limited as police continue the investigation.
Why Starlink matters
Starlink’s satellite network has become a strategically important communications backbone for Ukraine since Russia’s invasion. Its terminals and ground infrastructure enable resilient internet connectivity, which can support military coordination, civilian communications, and critical information flows. That strategic value makes such facilities an attractive target for actors seeking to disrupt Ukrainian capabilities or to send a geopolitical message.
Government and security responses
Bulgaria’s Interior Minister Ivan Demerdzhiev told parliament that while Starlink facilities are privately owned and thus their protection falls to owners, the state has introduced additional security measures at similar sites. Plamen Tonchev, head of Bulgaria’s State Agency for National Security (DANS), warned lawmakers that further acts of sabotage cannot be ruled out. Across Europe, the incidents have prompted closer scrutiny of vulnerable communications infrastructure and intensified cooperation between law enforcement agencies investigating possible transnational networks behind the attacks.
What remains unresolved
Key questions remain unanswered: who exactly directed or financed the attacks, whether they are coordinated under a single network, and the full extent of links between incidents in Poland, Bulgaria and arrests in Germany. Official investigations are ongoing, and authorities have so far released limited details to the public. For now, the pattern of strikes on Starlink infrastructure has raised alarms about the vulnerability of civilian-managed systems that have taken on strategic roles in wartime.
Licensed under CC BY-ND 4.0 International
