A Sofia court has kept in custody a 19-year-old Bulgarian hacker charged by prosecutors over breaches of the public broadcasters BNT and BNR, state bodies and companies, while his lawyer told the court there was no evidence he carried out the attacks. The man, identified by prosecutors only by the initials M. P., is charged, not convicted, and is presumed innocent.
The Sofia City Prosecutor’s Office says personal data, including national ID numbers, was copied from hacked systems and offered for sale in internet channels and hacker forums. Bulgaria’s Ministry of Interior says about a dozen companies and thousands of their customers and users were affected. The court ruling can be appealed, so the custody order is not yet final.
In brief
- Prosecutors charged a 19-year-old on 29 October with three computer-crime offences over breaches of BNT, BNR, state and municipal sites and companies.
- Police say he used AI and anonymising services and offered stolen personal data for sale; his lawyer says nothing ties him to the attacks.
- A Sofia court ordered pre-trial custody on 31 October; the ruling can be appealed within three days.
The defence says the evidence points elsewhere
At the custody hearing on 31 October, defence lawyer Yulian Stankov said his client had been made an administrator of the Telegram channel through which the data allegedly leaked only on 24 October, days before he was detained, according to BTA, Bulgaria’s state news agency. Nobody had checked who owned the channel or whether his client was involved before that date, Stankov said.
The lawyer told the court there was no evidence that his client was the author of the attacks or that he had access to the systems of BNR and BNT. He said none of the witnesses, including an officer of GDBOP, the police directorate against organised crime, said they knew the accused. He pointed to a separate Telegram channel used for illegal activity that, he said, has no link to his client, and to cryptocurrency accounts that only the channel’s owner can use. He added that the young man has a clean record and handed over the seized items voluntarily.
The defence asked for bail or house arrest, BNT reported. BNT is itself one of the named victims. The court found he was not likely to flee but might commit a new offence, even though he has no previous convictions. Citing witness testimony, seized computers and technical reports, it found a reasonable assumption that he committed the offences, BTA said.
“We are satisfied,” prosecutor Mihaela Nikolaeva told BNT, saying the court had found, “even at this early stage”, a reasonable assumption that the accused committed the acts. Specialist outlet e-security.bg reported that a hearing is set for 5 November if an appeal is lodged.
What the Bulgarian hacker charged on 29 October is accused of
Prosecutors charged him on 29 October under three provisions of the Criminal Code: unlawful access to information systems (Article 319a(1)); copying a database containing personal data for financial gain (Article 319b(3) with 319b(1)); and unlawfully altering computer data (Article 319b(1)). The most serious charge carries five to seven years in prison. The pre-trial case was opened on 28 October and is run by GDBOP under the prosecutor’s supervision.
According to the prosecutor’s office, the data taken included names, phone numbers, ЕГН personal identification numbers, home and email addresses and purchase histories, along with email correspondence. It says there is also evidence that he called for the spread of “Cobra Stealer”, malware designed to steal information.
The police release on the Bulgarian hacker charged that week adds detail that the prosecutor’s statement leaves out. It says he went by two pseudonyms online, “used the capabilities of artificial intelligence” for the crimes and tried to hide his digital traces through anonymising services. Electronic devices, storage media and documents were seized. The police release refers to four articles of the Criminal Code but lists the same three provisions as prosecutors. It says the investigation continues to establish the full scope of the systems and data affected.
Leaked ID numbers outlast the breach
For the people whose records were taken, the case in court matters less than where the data went. Prosecutors say it was offered for sale in channels and forums. Whoever is eventually held responsible, a list that joins names, ЕГН numbers, home addresses and purchase histories can still be used, and an ID number cannot be changed the way a password can.
From a compliance view, that is the part with the longest tail. A record of that kind is the raw material for impersonation: opening accounts in someone else’s name, passing basic identity checks or making phishing messages look genuine. For firms that onboard Bulgarian customers, the sensible response to a case like this is to treat matching personal details as weaker proof of identity for a while, and to watch for new accounts built on them.
The police claim about AI fits a wider pattern TSN has tracked, from the VOLTA infostealer that sends stolen data to AI models to rank victims, to public-sector outages such as Belgium’s MyMinfin attack. If the police account holds and one person reached this many systems, the gap lies in basic security at the victims as much as in any attacker’s skill.
The other lesson is about proof. For the Bulgarian hacker charged here, custody needed only a reasonable assumption; a conviction needs evidence that he did the hacking, not only that he ran a channel where data appeared. The defence has set out exactly that gap. Cases like the Syrian Electronic Army sentencing show that attribution in hacking cases is usually settled by device and account evidence, which here has not yet been tested in open court.
A possible appeal hearing on 5 November
If the defence appeals, the next step is the hearing that e-security.bg says is set for 5 November. Police are still mapping which systems and data were hit, and for the thousands of customers involved, that list matters more than the custody order facing the Bulgarian hacker charged in the case.
Sources
Primary:
- Sofia City Prosecutor’s Office: charges for computer crimes, 30 October 2026
- Ministry of Interior (GDBOP): 19-year-old detained over cyberattacks, 30 October 2026
Press:
- BNT: court keeps the 19-year-old in custody, 31 October 2026
- BTA: court orders custody for the 19-year-old, 31 October 2026
- e-security.bg: court keeps the accused in custody, 1 November 2026
Related stories
- Syrian Electronic Army Hacker Gets 42 Months for Pro-Assad Attacks
- VOLTA Infostealer Sends Stolen Data to AI Models to Rank Victims
- Belgium’s Finance Ministry Takes MyMinfin Offline After a Cyberattack
Image: Bjoertvedt / Wikimedia Commons, CC BY-SA 4.0, modified by TSN; this image is also CC BY-SA 4.0
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
