Sofia City Court has ordered a 19-year-old man to stay in custody. He is charged with illegally breaking into the websites of state and local institutions, firms and national media, including BNT and BNR. The court cited the risk that he would commit another crime.

The man and his lawyer have 3 days to appeal to a higher court.

How it all started: Man, 19, charged with hacking websites of state bodies, BNT and BNR

Sofia City Prosecutor's Office charged him yesterday and held him for up to 72 hours. He is charged with four computer crimes. Each carries a prison term, and one carries 5 to 7 years.

Prosecutors say the man broke into information systems and copied databases containing names, phone numbers, personal ID numbers, addresses, emails, purchase histories and other data. He is also charged with changing computer data without permission. According to the charge, he wanted to make money from it. Prosecutors also say there are indications that he urged others to spread Cobra Stealer, malware designed to steal information.

The court found that witness statements, seized computers and technical reports give reasonable grounds to believe he committed the crime.

Prosecutor Mihaela Nikolaeva said the man used a VPN, which gives maximum anonymity and is often used to break into systems and networks illegally. She said he posted the data on forums where such information is traded. Nikolaeva called him a person who poses a high danger to the public.

Lawyer Yulian Stankov asked for a lighter measure than custody, and the accused asked for house arrest. The defence says there is no proof that he carried out the act or is linked to it. Stankov said the man handed over the seized items voluntarily.

The lawyer also said there is no evidence that the accused was linked to General Group on 27 September 2026, acted on 12 October, or broke into the BNR and BNT systems. He said no witness, including the officer from the organised crime directorate (GDBOP), has said they know the accused, and that the statements lack detail. The man told the court: "When General Group was hacked, Project Set did not even exist, and this can be checked."

Stankov said that, by the accused's own account, he became administrator of the Telegram channel through which information is said to have leaked on 24 October, just five days before his arrest. Nobody has checked whether he took part in the channel earlier, or who the owner was who appointed him. The lawyer said experts could easily establish this. He said there is also another, separate channel with data on illegal activity, which the man has no link to. The cryptocurrency accounts are used only by the channel's owner.

Stankov said nobody knows how long the router, which the crime is thought to have been committed through, has been running, or whether any information leaked through it. He said the accused has a clean criminal record, and that claims about his mother and about criminal behaviour before he turned 18 are invented and untrue. The man lives only with his mother, after his father was shot dead in 2024.