Webcam and satellite imagery pin Bulgaria's Starlink arson to the Plana Earth Station

TLDR

• Open-source geolocation points to the Plana Earth Station near Sofia as the site where 11 Starlink antennas were reportedly burned.¹²
• The case shows geolocation can identify a sensitive site while officials stay silent.²³
• The prime minister neither confirmed nor denied the claim at first; prosecutors later charged two German nationals in absentia.³¹¹

Bulgaria is investigating a reported arson attack on Starlink ground infrastructure, and the main public evidence for where it happened comes from a fire video posted by an opposition MP, a surveillance still, satellite imagery and a public webcam.

Why it matters: the case shows how far geolocation can establish a sensitive site's identity while officials stay silent, and it follows a September Starlink station fire in central Poland that the Polish digital affairs minister called sabotage.³

Driving the news:

• Mirchev, co-chair of the Yes, Bulgaria party, posted a video of the fire on Facebook, saying two masked people burned 11 of 17 antennas at a "secret facility" near Sofia.¹²³
• Surveillance footage he posted shows a distinctive antenna and a sign reading "Plana Earth Station". The Insider says satellite imagery shows spherical structures typical of Starlink ground stations at the Plana site, roughly 20 kilometres south of Sofia.²
• Capital.bg matched the site to the Plana teleport, a Vivacom station near the village of the same name. It reports that a Google image from 2025 shows ten antennas, that the site does not appear in 2021 imagery, and that archive footage from a public webcam shows antenna installation beginning in August 2024.¹
• Capital.bg's reading of the same webcam archive puts the start of the fire at around 10:20 on 9 October, lasting about an hour. Mirchev's own account, as relayed by Capital.bg, placed the attack on the evening of 9 October, while The Insider says it is unclear exactly when the fire was set.¹²
• Capital.bg says property records show the land belongs to the Bulgarian Telecommunication Company, the former name of Vivacom Bulgaria. Neterra, Starlink's official distributor in Bulgaria, told the daily Dnevnik the infrastructure is not its property and its own network is unaffected.¹
• The webcam also shows people removing some of the damaged equipment between about 12:00 and 16:30 on 13 October. Capital.bg says there is no information on whether they were company staff or investigators.¹
• Prime Minister Rumen Radev told parliament the investigation is "extremely intensive" without confirming or denying the claim, according to AFP. A Sofia prosecutor's office spokesman confirmed an investigation but said no one has been charged, and Interior Minister Ivan Demerdzhiev said security would be tightened around similar facilities.³
• State Agency for National Security head Plamen Tonchev said the site was due for expansion and part of its fencing had been removed, which appears to have made access easier.²

The big picture: the sources disagree on several points that remain unresolved. The Insider says the station provides service used in part by the Ukrainian military, while Meduza, citing Bulgarian National Television, says there was no word on whether the damaged antennas served Ukraine's forces, and Capital.bg says nothing is known about the extent of the damage or any service disruption.¹²⁴ The Insider describes the prime minister as having confirmed the incident, whereas AFP says he did neither.²³ On attribution, Mirchev pointed to the Starlink fire in Poland, saying Polish authorities have no doubt Russia is behind it.⁴ AFP reports that Prime Minister Donald Tusk called that blaze an "act of hybrid warfare" and that German police detained three men and a woman, while The Insider says two suspects were detained in Germany.²³ The Insider says there is currently no evidence to support Mirchev's suggestion of Russian involvement in the Bulgarian case.²

Update, 17 October 2026: Meduza, summarising a Der Spiegel report that cites unnamed sources, says Russian intelligence may have hired the Turkish "Daltons" gang for the 23 September arson at the Starlink station in Wola Krobowska, Poland, and that the two suspects likely belong to the gang or may have acted at the direction of its supporters.⁵ It says the two Turkish citizens were arrested on 12 October in Nürtingen, Germany, at Poland's request, and that a Stuttgart court is expected to rule in the coming days on their extradition.⁵ Der Spiegel, as relayed by Meduza, says that if confirmed this would point to a shift away from low-level agents.⁵ The report does not mention Bulgaria, and the sources reviewed here do not show that the Bulgarian and Polish incidents were carried out by the same group.⁵⁶ On the Bulgarian side, siexpo.bg reports that Faktor.bg, citing unnamed prosecution sources, said two people were arrested on 12 October in connection with the Plana fire, but siexpo.bg found no official confirmation, and prosecutors later said no one was detained on 12 October (see the 20 October correction below).⁶¹¹ It also cites BTA saying Prime Minister Radev confirmed an investigation in parliament, working with partner services and withholding details.⁶ siexpo.bg says the Polish Interior Ministry's 12 October statement links two Turkish citizens arrested in Germany to the 23 September fire, and that a German court ordered them held in custody, citing BTA and DPA.⁶ Meduza and siexpo.bg both give two suspects in Germany, in line with The Insider's account above and unlike AFP's report of three men and a woman, and the sources do not explain the difference.²³⁵⁶ siexpo.bg also notes that BNT puts the number of antennas at the site at 17 and Faktor.bg at 18, with 11 burned in both accounts, and it does not calculate a percentage.⁶ It cites BNT, drawing on BNR, saying the State Agency for National Security chairman, Tonchev, warned that further sabotage is possible.⁶

Update, 19 October 2026: Lithuania has reported a third suspected attack on Starlink-related infrastructure in Europe in under a month, following the fires in Poland and at Plana, according to Euromaidan Press.⁹ Prime Minister Mindaugas Sinkevičius said an attempt to set fire to a Lithuanian company storing Starlink equipment began just after midnight on Sunday 18 October and failed because security had been stepped up after a warning.⁷⁸ He told LRT Radio that satellite antennas and a control unit were targeted at around 02:00 and that incendiary liquid was found in containers of three to 10 litres.⁷ Euromaidan Press, citing LRT, says the company provides connectivity through nine Starlink antennas used by Ukraine, and that police said no suspects had been detained and any damage was minimal.⁹ Sinkevičius called it part of Russia's hybrid war and said it was likely already clear that the Russian side had commissioned it, but gave no details while the investigation continues.⁷⁹ The reports reviewed rest on statements by the prime minister, the defence minister and police, and none names the company or its location.⁷⁸⁹ On the Bulgarian side, Fakti.bg, citing unnamed prosecution sources, reported that two people aged 20 and 21 had been detained on 12 October at the Kulata crossing; prosecutors have since said no one was detained that day, as set out in the 20 October correction below.¹⁰

Update, 20 October 2026: this corrects the 19 October paragraph on the Bulgarian arrests. On 19 October the Sofia City Court authorised European Arrest Warrants for two German nationals, and prosecutors say they were charged in absentia on 14 October, not detained on 12 October.¹¹¹² BTA reports that the two were born in 2007, making them 19, and that their whereabouts are unknown according to German authorities.¹¹ Sofia Globe says reports on 19 October indicated that the pair had already left Bulgaria.¹² This contradicts the earlier Fakti.bg report, which cited unnamed prosecution sources for the detention of two people aged 20 and 21 at the Kulata crossing, and that report is not supported by the sources reviewed.¹⁰¹¹¹² The prosecution says they entered through the Kalotina checkpoint at 17:37 on 9 October, posing as tourists, and left for Serbia in a German-registered car at 23:55 through the same checkpoint.¹¹ It puts the fire at around 22:25 that evening and says gloves and masks were used.¹¹ DW says the prosecutors' count of 18 antennas was three destroyed, two partially burned and three damaged, and BTA cites the same breakdown, whereas Sofia Globe says 11 were destroyed and MP Ivaylo Mirchev's original post said 11 of 17 were set alight.¹¹¹²¹³ The car is registered in Germany and is not owned by either suspect, per Sofia Globe, and the two court-appointed defence lawyers argued the suspects had not been identified and said they would appeal.¹¹¹² The ruling can be appealed within three days, and the suspects face three to 12 years in prison if convicted.¹¹ DW notes the case is reminiscent of the Polish one but does not state a link, and the 19 October reports reviewed give no public confirmation of a connection.¹³