Article 319g of the Criminal Code – Computer Viruses and Malware: The Punishable Side of Hacking

What does Article 319g CC regulate?

Article 319g of the Bulgarian Criminal Code addresses one of the most dangerous modern crimes — introducing a computer virus or other malicious program into an information system or network.

This provision criminalizes not just access or data manipulation, but the intentional introduction of destructive software capable of disrupting, blocking, or controlling other people’s digital systems.

• Paragraph 1 focuses on classic viruses — programs that infect, damage, or block computer resources.

• Paragraph 2 extends the scope to other types of malicious software — so-called Trojan horses, spyware, keyloggers, rootkits, etc., which may not directly damage resources but are designed to collect, erase, or copy data without the owner’s knowledge or permission.

What are the penalties?

The legislator provides proportionally severe penalties depending on the seriousness of the act:

• Basic offence: up to 7 years imprisonment and a fine of up to 5,000 BGN;

• If significant damage or repeat offence: up to 9 years imprisonment and a fine of up to 20,000 BGN;

• If critical infrastructure is affected (e.g. national security, healthcare, energy): 5 to 12 years imprisonment and a fine of up to 20,000 BGN.

These sanctions clearly show: these are not minor “hacker pranks” but a real threat to public order and security.

What acts fall under this article?

Examples include:

• A hacker introduces a virus into a bank’s network, temporarily blocking access to online banking;

• A programmer uploads a Trojan to a website to collect visitors’ credit card data;

• A former employee infects the company server with ransomware that encrypts all files and demands ransom;

• A cyberattack against a hospital system that disables access to patient records — a case qualifying as affecting critical infrastructure.

Practice in Bulgaria

Court practice under Article 319g is still limited, as such crimes are often hidden behind anonymous profiles, foreign IP addresses, and complex technological schemes.

Nevertheless, in recent years the prosecution has increasingly brought charges, especially for attacks against online platforms, corporate networks, and electronic registries.

Example from 2023: During an investigation of an IT attack on a municipal website, it was found that the virus was created by a local IT specialist who claimed he wanted to demonstrate system vulnerabilities. Despite the “benevolent” motive, the court held the act punishable because it was done without authorization.

Conclusion

Article 319g CC is a pillar in the fight against so-called “cyberterrorism.”
It aims not only to punish individuals but to deter attacks on the entire digital order.

In a world where computer systems run everything — from hospitals to airports — attacks on them are treated as attacks on society itself.

If you have been a victim of such a crime — infected computer, encrypted data, information leaks — contact a criminal law attorney immediately.
Only through professional legal analysis and cooperation with experts can you protect your rights and participate effectively in criminal proceedings.