Supreme Administrative Court of Bulgaria Listed by ransomhouse Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out public-sector institutions that hold sensitive judicial and administrative records, turning operational disruption into leverage for extortion. Against that backdrop, the Supreme Administrative Court of Bulgaria was listed on 27 January 2025 by the group known as ransomhouse, which claims to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and public detail on the precise scope is limited.

Because the court sits at the apex of Bulgaria’s administrative justice system, any confirmed compromise of its systems carries consequences that extend beyond the organisation itself to citizens, public officials and the integrity of judicial oversight. What follows is a factual account drawn only from the available record.

Inside the incident

On 27 January 2025 the Supreme Administrative Court of Bulgaria appeared on a listing associated with the ransomhouse ransomware group. The group claims that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access vector, the duration of unauthorised presence, the volume of data taken, or any ransom demand—have been disclosed in the public record. The number of individuals whose information may have been involved is likewise unknown. The listing itself constitutes a claim by the threat actor; independent confirmation of the full extent of the incident has not been provided in the available facts.

The group behind it: ransomhouse

Ransomhouse is a ransomware operation that has been observed conducting double-extortion campaigns: encrypting systems while simultaneously stealing data and threatening to publish it if payment is not made. Like many contemporary groups, it maintains a leak site on which it posts victim names and, in some cases, sample files to increase pressure. Public reporting on the group describes a model that often involves affiliates and emphasises data theft alongside encryption. In this instance the group claims the Supreme Administrative Court of Bulgaria as a victim and asserts that internal files were taken; no additional statements specific to this organisation beyond that listing appear in the facts provided. Attribution therefore rests on the group’s own claim rather than on independently verified forensic findings released to date.

About Supreme Administrative Court of Bulgaria

The Supreme Administrative Court of Bulgaria exercises supreme judicial supervision over the precise and uniform application of laws in administrative justice. It hears complaints and protests against acts of the Council of Ministers, the Prime Minister, Deputy Prime Ministers, Ministers, heads of bodies directly subordinate to the Council of Ministers, acts of the Supreme Judicial Council, acts of the Bulgarian National Bank, regional governing acts, and other actions specified by law. It also rules on disputes concerning the legality of such measures. As the final instance for many administrative matters, the court routinely handles case files, pleadings, decisions, personal data of litigants and officials, and internal administrative records. A breach affecting an institution of this standing can undermine public confidence in the confidentiality of judicial processes and expose sensitive governmental and personal information.

What was likely exposed

The available facts state that internal files were exfiltrated in a ransomware attack. Exact data types beyond that description, file volumes, and the identities of any individuals whose records may be included remain undisclosed. Organisations of this kind typically maintain case documents, correspondence with other state bodies, personnel records, and materials containing personal identifiers of parties to proceedings. Because the precise contents have not been confirmed publicly, it is not possible to state with certainty which categories of information left the court’s control. Readers should treat any subsequent claims of specific document dumps as unverified until corroborated by official sources.

What's at stake

For individuals whose data may appear in court files, risks include unwanted disclosure of personal circumstances, potential misuse of identifiers for fraud or social engineering, and secondary harms such as reputational damage or targeted harassment. For the court itself, the incident raises operational, legal and reputational considerations: possible interruption of case management, obligations under data-protection rules, and the need to restore confidence that judicial records remain secure. Even when encryption is reversed or systems are rebuilt, the mere fact of exfiltration can leave residual exposure if copies of the data circulate. The absence of confirmed victim counts means the full human impact cannot yet be quantified, but the institutional role of the court makes any leakage consequential for the wider administrative-justice system.

Were you affected?

If you have had dealings with the Supreme Administrative Court of Bulgaria—whether as a litigant, counsel, official or staff member—consider the following practical steps:

• Monitor official statements from the court or competent Bulgarian authorities for any confirmation of affected data categories and guidance on next actions.
• Review personal and professional accounts for unusual activity and enable multi-factor authentication where available.
• Be alert to phishing or social-engineering attempts that reference court proceedings or administrative matters.
• If you believe your personal data may have been involved, document any suspicious contacts and consider placing fraud alerts with relevant financial or identity services.
• You can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

Public detail remains limited; further verified information, if released, will clarify the true scale of exposure. Until then, measured vigilance is the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.