Loading signal...
Signal
Submitted
Feb 1, 2026, 00:14 UTC
Estonian police identified a well-known hacker as the suspect in the December 20, 2025, Ülemiste shopping center trash can bombing.
The December 20, 2025 bombing involved an improvised explosive device placed in a trash can at Ülemiste, Estonia's largest shopping mall. Authorities quickly identified a male suspect residing in Tallinn's Nõmme district, known for previous convictions in large-scale hacking and threats of violence. Investigators employed mobile subscriber queries and court-authorized surveillance that led to the suspect's identification and subsequent searches conducted by police and the Prosecutor's Office. While the suspect is linked to prior cybercrimes and violence threats, the motive for the bombing and the connection to the explosion remain under investigation. The case highlights ongoing security concerns around cybercrime and hybrid threats in Estonia.
Confidence: High
Classified as aggressor because the article describes a suspected terrorist bombing linked to an individual with a history of cybercrime and violent threats targeting Estonian infrastructure. There are no mentions of defense or security preparations as the primary event, so defense preparatory event is set to false.
Source URL
https://news.err.ee/1609893010/ulemiste-bombing-suspect-identified-as-well-known-hacker
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "4f0361b3-c128-4328-ad1a-ce283f2c3930",
"url": "https://news.err.ee/1609893010/ulemiste-bombing-suspect-identified-as-well-known-hacker",
"source": "extension",
"status": "approved",
"category": "Terrorism & Criminal Proxy Tactics",
"subcategory": "Terrorism",
"incident_type": "Bomb threats, assassination plots, targeted killings",
"country": "Estonia",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Estonia",
"terrorism",
"bombing",
"Ülemiste shopping center",
"hacking",
"cybercrime",
"criminal suspect",
"explosions",
"law enforcement"
],
"nodes": [],
"countries": [],
"where_text": "Land",
"headline": "Ülemiste bombing suspect identified as well-known hacker",
"description": "On Saturday, a trash can bombing occurred at Estonia's biggest shopping center Ülemiste. The alleged culprit is a well-known individual previously convicted of large-scale hacking and threats of violence. Police investigations included mobile phone subscriber number queries and court-ordered surveillance to identify the suspect. The suspect is believed to be a male resident in the Nõmme district of Tallinn. Police detected the suspect through data queries and other intelligence methods. The police and prosecutor's office conducted searches and questioning following the explosion. The suspect was already known from previous crimes and threats but no direct motive for the bombing has been publicly stated yet.",
"summary_short": "Estonian police identified a well-known hacker as the suspect in the December 20, 2025, Ülemiste shopping center trash can bombing.",
"summary_extended": "The December 20, 2025 bombing involved an improvised explosive device placed in a trash can at Ülemiste, Estonia's largest shopping mall. Authorities quickly identified a male suspect residing in Tallinn's Nõmme district, known for previous convictions in large-scale hacking and threats of violence. Investigators employed mobile subscriber queries and court-authorized surveillance that led to the suspect's identification and subsequent searches conducted by police and the Prosecutor's Office. While the suspect is linked to prior cybercrimes and violence threats, the motive for the bombing and the connection to the explosion remain under investigation. The case highlights ongoing security concerns around cybercrime and hybrid threats in Estonia.",
"actor_primary": "well-known hacker suspect",
"target_primary": null,
"location_text": "Ülemiste shopping center, Tallinn, Estonia",
"location_region": null,
"location_coordinates_lat": 58.595272,
"location_coordinates_lon": 25.013607,
"location_precision": "Exact",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "Classified as aggressor because the article describes a suspected terrorist bombing linked to an individual with a history of cybercrime and violent threats targeting Estonian infrastructure. There are no mentions of defense or security preparations as the primary event, so defense preparatory event is set to false.",
"event_time_utc": "2025-12-20T16:45:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm1h",
"created_at": "2026-02-01T00:14:32.328Z",
"updated_at": "2026-11-09T00:08:57.270Z",
"reliability_band": "strong",
"location_precision_band": "exact",
"time_precision_band": "within_1h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Dec 20, 2025, 16:45 UTC
Event time confidence
pm1h
Location
Ülemiste shopping center, Tallinn, Estonia
Primary actor
well-known hacker suspect
Country
Estonia
Tags
Estonia, terrorism, bombing, Ülemiste shopping center, hacking, cybercrime, criminal suspect, explosions, law enforcement
Signal
Submitted
Feb 1, 2026, 00:14 UTC
Estonian police identified a well-known hacker as the suspect in the December 20, 2025, Ülemiste shopping center trash can bombing.
The December 20, 2025 bombing involved an improvised explosive device placed in a trash can at Ülemiste, Estonia's largest shopping mall. Authorities quickly identified a male suspect residing in Tallinn's Nõmme district, known for previous convictions in large-scale hacking and threats of violence. Investigators employed mobile subscriber queries and court-authorized surveillance that led to the suspect's identification and subsequent searches conducted by police and the Prosecutor's Office. While the suspect is linked to prior cybercrimes and violence threats, the motive for the bombing and the connection to the explosion remain under investigation. The case highlights ongoing security concerns around cybercrime and hybrid threats in Estonia.
Confidence: High
Classified as aggressor because the article describes a suspected terrorist bombing linked to an individual with a history of cybercrime and violent threats targeting Estonian infrastructure. There are no mentions of defense or security preparations as the primary event, so defense preparatory event is set to false.
Source URL
https://news.err.ee/1609893010/ulemiste-bombing-suspect-identified-as-well-known-hacker
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "4f0361b3-c128-4328-ad1a-ce283f2c3930",
"url": "https://news.err.ee/1609893010/ulemiste-bombing-suspect-identified-as-well-known-hacker",
"source": "extension",
"status": "approved",
"category": "Terrorism & Criminal Proxy Tactics",
"subcategory": "Terrorism",
"incident_type": "Bomb threats, assassination plots, targeted killings",
"country": "Estonia",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Estonia",
"terrorism",
"bombing",
"Ülemiste shopping center",
"hacking",
"cybercrime",
"criminal suspect",
"explosions",
"law enforcement"
],
"nodes": [],
"countries": [],
"where_text": "Land",
"headline": "Ülemiste bombing suspect identified as well-known hacker",
"description": "On Saturday, a trash can bombing occurred at Estonia's biggest shopping center Ülemiste. The alleged culprit is a well-known individual previously convicted of large-scale hacking and threats of violence. Police investigations included mobile phone subscriber number queries and court-ordered surveillance to identify the suspect. The suspect is believed to be a male resident in the Nõmme district of Tallinn. Police detected the suspect through data queries and other intelligence methods. The police and prosecutor's office conducted searches and questioning following the explosion. The suspect was already known from previous crimes and threats but no direct motive for the bombing has been publicly stated yet.",
"summary_short": "Estonian police identified a well-known hacker as the suspect in the December 20, 2025, Ülemiste shopping center trash can bombing.",
"summary_extended": "The December 20, 2025 bombing involved an improvised explosive device placed in a trash can at Ülemiste, Estonia's largest shopping mall. Authorities quickly identified a male suspect residing in Tallinn's Nõmme district, known for previous convictions in large-scale hacking and threats of violence. Investigators employed mobile subscriber queries and court-authorized surveillance that led to the suspect's identification and subsequent searches conducted by police and the Prosecutor's Office. While the suspect is linked to prior cybercrimes and violence threats, the motive for the bombing and the connection to the explosion remain under investigation. The case highlights ongoing security concerns around cybercrime and hybrid threats in Estonia.",
"actor_primary": "well-known hacker suspect",
"target_primary": null,
"location_text": "Ülemiste shopping center, Tallinn, Estonia",
"location_region": null,
"location_coordinates_lat": 58.595272,
"location_coordinates_lon": 25.013607,
"location_precision": "Exact",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "Classified as aggressor because the article describes a suspected terrorist bombing linked to an individual with a history of cybercrime and violent threats targeting Estonian infrastructure. There are no mentions of defense or security preparations as the primary event, so defense preparatory event is set to false.",
"event_time_utc": "2025-12-20T16:45:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm1h",
"created_at": "2026-02-01T00:14:32.328Z",
"updated_at": "2026-11-09T00:08:57.270Z",
"reliability_band": "strong",
"location_precision_band": "exact",
"time_precision_band": "within_1h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Dec 20, 2025, 16:45 UTC
Event time confidence
pm1h
Location
Ülemiste shopping center, Tallinn, Estonia
Primary actor
well-known hacker suspect
Country
Estonia
Tags
Estonia, terrorism, bombing, Ülemiste shopping center, hacking, cybercrime, criminal suspect, explosions, law enforcement