The 2012 Burgas bus bombing was a terrorist attack carried out by a suicide bomber on a passenger bus transporting Israeli tourists at the Burgas Airport in Burgas, Bulgaria, on 18 July 2012. The bus was carrying 42 Israelis, mainly youths, from the airport to their hotels, after arriving on a flight from Tel Aviv. The explosion killed the Bulgarian bus driver and five Israelis and injured 32 Israelis, resulting in international condemnation of the bombing.
In February 2013, Tsvetan Tsvetanov, the Bulgarian Interior Minister, said there was "well-grounded" evidence that Hezbollah was behind the attack. Tsvetanov stated that the two suspects had Canadian and Australian passports and lived in Lebanon. According to the Europol, forensic evidence and intelligence sources all point to Hezbollah's involvement in the blast. Both Iran and Hezbollah have denied any involvement. On 5 June 2013, new Bulgarian Foreign Affairs Minister Kristian Vigenin stated that: "There is no conclusive evidence for the implication of Hezbollah in the July 2012 bombing in Burgas. The authorities continue to gather evidence." However, two weeks later a Bulgarian representative to the European Union revealed that investigators discovered new evidence that implicates Hezbollah operatives were connected to the terrorist attacks. Investigators found that the forged documents used by the perpetrators of the attack were facilitated by a man with ties to Hezbollah. In July 2013, the newly appointed Bulgarian Interior Minister Tsvetlin Yovchev stated: "there are clear signs that say Hezbollah is behind the Burgas bombing."
On 25 July 2013, the Bulgarian Interior Ministry released photographs of two Hezbollah operatives suspected in the bombing: Australian citizen Malid Farah (also known as "Hussein Hussein"), and Canadian citizen Hassan al-Haj. In 2013, and partly in response to the bombing, the EU unanimously voted to list the military branch of Hezbollah as a terrorist organization.
On 18 July 2014, Bulgaria announced that they identified the bomber as a dual Lebanese-French citizen named Mohamad Hassan El-Husseini. Over 12 years after the attack, in April 2025, following a negotiation with Lebanon's former head of intelligence Abbas Ibrahim, the Bulgarian authorities released the bomber's remains for burial in Lebanon. Although Hezbollah never formally claimed responsibility for the attack, El-Husseini was buried in a southern Beirut cemetery designated for the organization's fallen fighters.
Attack
Six civilians and the suicide bomber were killed and at least 32 were injured in an explosion on an Israeli-operated tour bus at the Burgas Airport in the Black Sea city of Burgas. In addition, two other buses were damaged in the blast.
Bulgarian leaders, including President Rosen Plevneliev, rushed to the site. The Foreign Ministry said authorities believed that the blast was a terrorist attack. According to the initial reports of Bulgarian authorities, the blast was caused by a bomb in a luggage compartment. However, it was later argued by a Bulgarian official that the blast was probably carried out by a male suicide bomber with fake US documents.
An 11-year-old child and two pregnant women were among the injured, while another pregnant woman was killed. Mustafa Kyosev, the Bulgarian bus driver, was also killed at the age of 36.
Survivors of the attack described people being thrown into the air, people shouting and crying, and recalled seeing body parts. The witnesses said that the explosion began at the front of the bus and sent fire down through the vehicle. Some passengers on the bus jumped out of windows to escape.
Two days after the attack, Bulgarian Interior Minister Tsvetan Tsvetanov said that the bomb was carried in the backpack of a man who was filmed on security cameras at the airport. Tsvetanov added that the bomb was detonated in the luggage compartment of the bus, and that the blast was caused by 3 kilograms of TNT powder. In 2020, however, the bomb was identified as an ammonium nitrate-based device.
Perpetrator investigations
Following the attack, a probe was launched to determine who was responsible for the attack. Bulgarian Interior Minister Tsvetan Tsvetanov said that the investigation might take years. On 12 August, a probe into the attack concluded that the perpetrator was a suicide bomber, which disproved other possible theories, such as being a deluded drug smuggler. On 17 August, Tsvetanov said that the probe indicated that a country or terrorist organization was responsible for the bus bombing, but did not name any suspects.
Description
On 19 July, Tsvetanov stated that the suspected attacker is seen on security camera tape near the bus for about an hour before the blast and that he had a fake driver's license from the U.S. state of Michigan. The suspected bomber was described as a white male with long hair and wearing glasses.
Burgas prosecutor Kalina Tchapkanova quoted witnesses who said that the perpetrator "spoke English with a slight accent" and appeared to be Arab, while the wife of the owner of a car rental service said she was sure that the perpetrator was of Arab origin, and that he had a shaved head. The Bulgarian prosecutors said that the attacker had short hair, as opposed to the long hair seen in footage captured by a security camera at the airport, while a witness said that the perpetrator appeared to be wearing a wig. Other witnesses said that they saw the perpetrator speaking to tourists at local beaches in the days prior to the attack, and one witness said that the man told a group of tourists that his mother was Dutch and his father was Iranian.
On 24 July, Bulgarian prime minister Boyko Borisov said that a sophisticated group of conspirators who spent at least a month in Bulgaria before the bombing were responsible for the terrorist attack, confirming suspicions that the perpetrator was not alone. Prime Minister Borisov said that those involved in the bombing used leased vehicles and moved in different cities so they wouldn't be seen together. He added that the perpetrators were "exceptionally skilled" and that they operated under "strict conspiracy rules." Prime Minister Borisov said that officials believe he might have flown into Bulgaria from a European country in the Schengen passport-free travel zone, of which Bulgaria was not yet a member, and Bulgaria is exploring that lead with officials in other European countries. Prime Minister Borisov added that DNA samples from the suicide bomber was shared with all partner security services, but no match has been found yet in their databases. European security officials also said that images of the suicide bomber have not yet matched any of their databases, but it's possible the suicide bomber was not on a watch list.
On 5 February 2013, it was reported that the suspect was a dual Canadian-Lebanese national living in Lebanon.
On 18 July 2014, Bulgaria announced that they had identified the bomber as 25-year-old Lebanese-French citizen Mohamad Hassan El-Husseini through DNA testing. In April 2025, his remains were repatriated to Lebanon following negotiations with Bulgaria and was buried in a cemetery designated for Hezbollah fighters.
Accomplices
On 16 August, the Bulgarian authorities released a computer-generated image of a suspected accomplice, saying that "There is data that the man is related to the terrorist attack at the airport." The authorities thought it belonged to the suicide bomber, but a facial reconstruction determined that this was not the case, and raised the possibility of an accomplice. The authorities said that the suspected accomplice may have used various aliases while planning the terrorist attack, and used a fake driving license registered to "Ralph William Rico" from Grand Rapids, Michigan.
On 21 August, a man from Plovdiv, a southern Bulgarian, said that he recognized the suspected accomplice, who he said he worked with for five years, and said that the accomplice is a Bulgarian who has been involved with people who preach Islamic extremism. Bulgarian police were investigating this lead as well.
In late August, on behalf of the Bulgarian government, Interpol attempted to recruit the help of member nations to identify one of the suspects in the investigation, and posted on its website an image of the alleged accomplice, urging anyone who had information about his identity to notify the authorities. The posted images include a copy of the fake driver's license in which the suspect seems to be wearing a wig. Interpol described the suspect as having possible Middle Eastern origin, 1.70–1.75 meters tall, and dark brown hair and eyes, who speaks English with an accent.
In October, Tsvetanov announced that the terrorist responsible for the attack had a maximum of five accomplices, all of which were foreign, and that the terrorist attack was plotted outside of Bulgaria for a year and a half.
Hezbollah and Iran
Immediately following the attack, Israeli prime minister Benjamin Netanyahu accused Hezbollah of carrying out the attack with the backing of Iran. Netanyahu vowed that Israel would "react firmly [to this] global Iranian terror onslaught"; Israeli president Shimon Peres promised retaliation against 'Iranian terrorist sites' around the world. Iran denied responsibility for the act. An Iranian Foreign Ministry spokesman rejected Netanyahu's accusation that the bombing was carried out by Hezbollah as a proxy for Iran as "baseless."
On 19 July, The New York Times reported that United States officials identified the suicide bomber as a member of Hezbollah. An unnamed senior official told The New York Times that the bomber had a fake Michigan driver's license, but there are no indications that he had any connection to the United States. He added that the attacker was "acting under broad guidance" to hit Israeli targets when opportunities presented themselves and that this guidance was given to Hezbollah from Iran, which uses Hezbollah as a proxy. Two other anonymous officials added that Hezbollah was behind the bombing, although declined to offer further information. One of the officials interviewed declined to describe what specific intelligence led to the belief that the bomber was from Hezbollah.
Although Iran has repeatedly denied supporting militant attacks abroad, a report by the New York City Police Department's intelligence analysts said that the suicide bombing in Burgas was the second plot unmasked there this year that is suspected to be perpetrated by Hezbollah and/or Iran. The report linked nine plots in 2012 in various countries to Iran or its proxies. That same day, Tsvetanov denied media reports that it was a local Hezbollah cell, saying that the possibility was not discussed. He added that the bomber was a foreign national who had been in the country for a minimum of four days, and was not Bulgarian, and also that investigators were following several leads, including that there was an accomplice. However, according to Vladimir Shopov, a political scientist at the New Bulgarian University, "For small Bulgaria to come out and openly name Hezbollah in such a way is as good as entering a minefield. There would have to be absolute certainty almost."
On 31 July, a member of the Bulgarian security establishment told The New York Times that there was a "clear direction that points to Hezbollah," in the pattern as well as evidence of the attack. White House Press Secretary Jay Carney stated, "It is certainly the case that Hezbollah and Iran have been bad actors, as a general matter, but we're not, at this point, in a position to make a statement about responsibility." The Pentagon has said that there were "distinctive Hezbollah markings" linked to the attack in Burgas, although at the time they could not "decisively state" who was responsible for the attack.
On 9 August, The New York Times reported that in the two months leading up to the terrorist attack, Israel's intelligence services intercepted numerous phone calls between Burgas and Lebanon, which increased significantly three days prior to the bombing. An Israeli official said, "We know the sources in Lebanon, though not the identity of those on the other end in Bulgaria." The New York Times also said that American and Bulgarian officials support Israel's assessment of the record, but won't announce that publicly. The newspaper also reported that a German intelligence official said there was skepticism regarding Hezbollah's involvement in the terrorist attack, and it is more likely that operatives with some connection to Hezbollah were used by Iran.
On 28 August, Lebanese newspaper Al-Jumhuriya reported that Bulgaria is "leaning toward" blaming Hezbollah for the terrorist attack. Iran has denied responsibility for the attack.
After Bulgaria's centre-right wing government was replaced by a Social Democratic-led one, the certainty about the charges were diminished.
Base of Jihad
On 21 July, an unknown group called "Base of Jihad" claimed responsibility for the attack in a statement that appeared on a Lebanese news site. However, a spokesman for Bulgaria's foreign ministry denied that the group was responsible.
Mehdi Ghezali
A few days after the attack, Bulgarian news sources published information alleging that the bomber was a Swedish citizen and former captive at Guantánamo Bay, Mehdi Ghezali. Swedish and Bulgarian authorities denied that these reports were correct, and United States officials said there was no evidence supporting the reports that Ghezali was responsible.
In early October 2012, the Bulgarian daily 24 Chasa gained access to an interview with a radical Salafi militant leader, Omar Bakri, who said that he recognized the suspect as being Mehdi Ghezali. After reports surfaced linking Ghezali to the attack, Bakri said that he called "my brothers in Great Britain" to determine the identity of the man, who told him that it was Mehdi Ghezali. In addition, Bakri said that his radical organization, Al-Muhajiroun, intended on paying damages to Mustafa Kyosov, the Muslim bus driver who was killed during the attack, but decided against this, because "Muslims are warned not to hang around near Jews if they don't want to get hurt." Bakri also alleged that Bulgaria and Eastern Europe was considered Islamic territory.