site.btaReport: National Security Agency Expelled 40 Foreign Nationals in Operations Countering Foreign Intelligence in 2025

The State Agency for National Security (SANS) expelled more than 40 foreign nationals in 2025 as part of its efforts countering foreign intelligence services operating in Bulgaria, according to the agency's annual report for 2025, published on the website of the Council of Ministers.

The report notes a case involving a Russian citizen whose activities were deemed to be against Bulgaria's interests and national security. The individual was expelled, his right of residence in Bulgaria was revoked, and he was banned from entering the country. Similar sanctions were also imposed on another Russian citizen.

In addition, the activities of another Russian citizen were disrupted due to alleged ties to the Russian intelligence services. By order of the Chairperson of SANS, he received a five-year ba on entering and residing within the territories of the Member States of the European Union.

The report also states that SANS rejected the applications of 25 foreign nationals seeking Bulgarian citizenship. According to the agency, the decisions were based on information indicating links to foreign intelligence services or involvement in other activities considered to pose a threat to Bulgaria's national security.

The report also notes a case involving a Bulgarian citizen who joined the Russian Armed Forces in Ukraine. According to information from SANS, the Sofia City Prosecutor's Office has opened a preliminary investigation into the case.

The report further states that, in the context of contemporary threats, Bulgaria continues to face certain challenges in implementing physical and information security measures for some strategic facilities.

Other significant developments creating risks to strategic facilities and activities in 2025 include:

- the need to ensure the continued operation of strategic industries and maintain energy security in the context of disrupted supply chains and sanctions imposed on Lukoil, which affect the company's assets in Bulgaria;

- the country's continued, though not fully overcome, dependence on Russian nuclear equipment, spare parts, and technical expertise;

- difficulties in balancing the electricity system due to the increased share of renewable energy sources and the limited operation of hydroelectric and thermal power plants;

- shortcomings in the maintenance and modernization of the electricity distribution and district heating networks, resulting in frequent outages and negatively affecting the quality of service provided to consumers;

- the deteriorating financial condition of major coal mining companies and delays in initiatives to retrain workers in the sector and repurpose mining sites for "green" energy projects;

- deficiencies in certain railway and road infrastructure construction, repair, maintenance, and modernization projects, some of which have implications for both economic development and road safety;

- vulnerabilities related to access to and the quality of healthcare services, as well as attempts to misappropriate public healthcare resources;

- shortages in the pharmaceutical market caused by logistical difficulties, uneven distribution, parallel export schemes, and growing consumption, including the use of medicines without a prescription;

- delays and irregularities in the absorption of European Union grant funding intended to support the sustainable development of infrastructure, the national economy, and scientific research and development;

- the increasing frequency of natural disasters and extreme weather events as a result of climate change, negatively affecting infrastructure, living conditions, and food security.

- vulnerabilities in the agri-food supply chain, leading to market distortions, unfair competition, unauthorized imports, and the distribution of food products and plant protection substances that pose risks to human health;

- shortcomings in the implementation of the state preventive program and violations of biosecurity measures by certain entities amid a worsening animal disease situation;

- disrupted river flow capacity, including as a result of illegal extraction of inert materials, uncontrolled deforestation and construction in certain areas, as well as the poor condition of some hydraulic facilities, creating conditions that increase the risk of flooding;

- air and water pollution caused by industry and agriculture, along with vulnerabilities in monitoring, control, and prevention mechanisms;

- deficiencies in the maintenance of water sources, water transmission systems, and irrigation infrastructure amid climate change and forecasts of a persistent shortage of water resources for household, energy, agricultural, and industrial needs;

- violations related to the storage of hazardous chemical substances.

SANS warns that, in line with global trends, the intensity of cyberattacks in Bulgaria continues to show a sustained upward trend. The majority of these attacks target state institutions and municipal administrations, critical infrastructure facilities, the transport sector, financial institutions, health insurance organizations, and others.

In response to the large volume of terrorist propaganda circulating online, the agency has been conducting systematic monitoring of the digital environment. These efforts are aimed at identifying activities involving the dissemination of radical messages and assessing possible exposure to such content among Bulgarian citizens and foreign nationals residing in the country. The necessary operational measures have been taken regarding both permanent and temporary residents originating from high-risk countries, due to the ongoing migration flows through Bulgaria.