Executive Assessment
According to reports an attack was carried out on a Starlink communications facility near Sofia, Bulgaria, on 9 October. It was further reported that 11 out of 17 facility’s antennas were set ablaze.
Bulgarian opposition MP Ivaylo Mirchev made the disclosure. Prime Minister Rumen Radev subsequently confirmed an investigation, while security officials described the incident as sabotage. The exact date of the fire and the identities and affiliations of the perpetrators require further official clarification. However, it is indicated that two individuals carrying German passports have been detained by the authorities.
The incident proceeded directly after the 23 September fire at a Starlink ground station in Wola Krobowska, Poland. Polish authorities have attributed that attack to suspected Russian intelligence activity and reported arrests in Germany. The temporal proximity raises the possibility of a wider campaign, but there is no substantial evidence disclosed linking the Bulgarian and Polish cases has not been made public.
The strategic concern extends beyond the immediate damage. Commercial satellite networks depend on terrestrial facilities, supporting power systems and communications links that can be more accessible to attackers than satellites in orbit. In such a scenario, even failed attempts can compel operators and governments to increase security expenditure, investigate potential networks and reconsider the resilience of critical infrastructure.
The Bulgarian incident points to a credible infrastructure-security vulnerability. Russian involvement remains yet to be substantiated in Bulgaria, and the available evidence does not establish that the two attacks were coordinated.
The Evidence and Its Limits
The Bulgarian case emerged through Mirchev’s disclosure, followed by government confirmation of an active investigation. Authorities reported that suspects had been identified but withheld further information to prevent the compromise on investigative operations. Media reports described two young men holding German passports, however that description does not establish their nationality, motive or affiliation as of yet.
The Polish investigation has produced more detailed public findings. Poland’s Internal Security Agency have stated that investigators examined forensic traces, surveillance footage and the suspects’ movements. Polish authorities identified two Turkish citizens residing in Germany as suspects and claim that the attack was orchestrated on behalf of a foreign intelligence service. They also described a separate individual suspected of conducting reconnaissance of the site. Polish authorities have alleged Russian intelligence involvement, although the underlying intelligence evidence remains inaccessible to the public. (Polish Internal Security Agency)
Importantly, the reported physical damage differed. In Bulgaria, reporting focused on antennas. In Poland, official accounts identified damage to power equipment serving the ground station. Both incidents concern satellite communications infrastructure, but their differences prevent a concrete conclusion that the same operational method was deployed.
Three explanations remain relevant.
The first is Russian-directed sabotage. Poland’s attribution and the broader European record of suspected sabotage make this a plausible hypothesis for Bulgaria. The second is that the Bulgarian investigation has not yet produced substantial evidence for public attribution, making official caution appropriate. The third is that other actors or motives remain possible. No affirmative evidence currently establishes an alternative perpetrator, but nationality and circumstantial similarities are insufficient to determine responsibility
Strategic Significance
The ground segment is a potential weak point in space-enabled communications. Satellites may be difficult to attack physically, but their supporting infrastructure is fixed, identifiable and dependent on terrestrial power, connectivity and security arrangements.
Arson offers a comparatively inexpensive means of testing those arrangements. Even when network redundancy prevents outage, an attack can impose costs through additional guarding, surveillance, infrastructure hardening and contingency planning. Its value to an adversary may lie in probing response times and exposing weaknesses rather than immediately disabling communications.
However, damage to individual antennas does not automatically translate into a significant loss of Starlink connectivity. The operational consequences depend on network architecture, alternative routing, redundancy and repair times. No confirmed evidence in the material reviewed establishes that the Bulgarian fire caused a measurable Ukrainian communications outage.
The wider issue is whether commercially operated infrastructure has adequate protection when it supports military functions. Private ownership does not remove national-security implications, particularly when facilities form part of communications networks used by a state at war.
The Separate Starshield Vulnerability
A second development underscores Ukraine’s dependence on external communications providers. On 13–14 October, Ukrainian forces reported that Starshield, the military-oriented satellite communications service, had initiated efforts for restricting connectivity when terminals moved faster than approximately 160 kilometers per hour.
The restriction reportedly affected some drone operations. On 16 October, the Associated Press reported that Ukraine was negotiating with SpaceX and the Pentagon to resolve the issue. Ukrainian officials said initial connectivity outages had been addressed, although the speed restriction remained. Elon Musk stated that the US government owns and controls Starshield. President Donald Trump denied ordering the restriction. The reason for the change remained unresolved in the reporting reviewed. (Associated Press, 16 October 2026). The situation further exposed the strategic vulnerabilities and risks of the system for end-users. It comes at a time of heightened relationship between Indian regulators and Elon Musk in his attempts to cover India as a strategic market for Starlink. While his rhetoric is about offering service to impoverished and disconnected areas of the country (an idea, which is strange, as Starlink’s advantage is solely tied to service in disconnected areas, while its cost is rarely on the lower side), the Indian response has been indicating inherent national security risk and increased dependency on decisions made in Washington. The incident and the responses from Elon Musk and Donald Trump just proved that the reservations that Indians authorities were real and significant.
The Bulgarian fire and Starshield restrictions must not be conflated. There is no evidence establishing a causal connection between them. Their strategic significance is nevertheless complementary. One illustrates the physical vulnerability of terrestrial infrastructure, while the other highlights Ukraine’s exposure to technical and policy decisions made outside its control.
Implications for Europe
For Bulgaria, the immediate priority is to secure and bolster comparable facilities, establish the perpetrators’ identities and communicate credible investigative progress without compromising sensitive operations. It may be inferred that the government would possibly assess whether satellite ground stations warrant formal critical-infrastructure designation and stronger minimum security standards.
Poland should share relevant forensic and intelligence findings with Bulgarian investigators. Cross-border cooperation may establish whether the incidents share handlers, recruitment channels or financing. Until then, the cases should be investigated as potentially related, not presented as a proven coordinated campaign.
It would be beneficial for European Union and NATO to develop stronger arrangements for protecting commercially operated infrastructure with strategic military value. Priorities include common risk assessments, incident reporting, intelligence-sharing and coordinated emergency-response procedures. Governments and operators must also clarify responsibility for security costs and rapid restoration.
Outlook and Recommendations
Over the next six months, further intrusions or attacks on satellite gateways and supporting communications infrastructure are a credible risk, although the evidence does not establish that a sustained campaign is underway. Formal charges, forensic disclosures, additional incidents and evidence of shared recruitment networks will be important indicators.
Four measures are essential:
- Protect critical infrastructure: Establish proportionate minimum security standards for satellite gateways and their supporting systems.
- Coordinate investigations: Share evidence across Bulgaria, Poland and Germany to test whether a common network exists.
- Maintain disciplined attribution: Highligh confirmed facts, official allegations and analytical hypotheses in public statements.
- Reduce operational dependency: Improve communications redundancy and clarify service-continuity arrangements for Ukraine.
Conclusion
The recent orchestrated Sofia arson incident indicates the need to view commercial satellite infrastructure as a strategic security concern. Its significance lies not only in the reported physical damage but in the vulnerability, which it exposes at the intersection of private ownership, national security and military dependence.
More on Starlink issues:
ISRO Cacophony: https://www.thestrategicperspective.org/isro-cacaphony/
Communication Security versus Insecurity: https://www.thestrategicperspective.org/communication-security-versus-insecurity/
Voices from Beijing: https://www.thestrategicperspective.org/voices-from-beijing/
Indian Defence Review and Policy of Hedging: https://www.thestrategicperspective.org/indian-defence-review-and-policy-of-hedging/
