In recent years, Poland and other countries bordering the Russian Federation have become targets of numerous hybrid attacks inspired by Kremlin intelligence services. The aim is destabilization, the creation of social unrest, and the weakening of support for Ukraine, which is fighting off Russian aggression. According to a report by the GLOBSEC/ICCT International Centre for Counter-Terrorism, more than 100 such incidents were recorded in Europe between 2022 and 2025, nearly 90 of which were successful. Below is a list of the most prominent acts of Russian sabotage directed against Poland and its allies.
In connection with the execution or preparation of sabotage acts in Poland, the Internal Security Agency (ABW) has detained dozens of individuals over the past three years. They were mainly citizens of Ukraine, Belarus, and Colombia, as well as Poles recruited by Russian services (GRU, FSB). Payment for a single act of sabotage could reach up to 10,000 euros.
Russian intelligence targets critical infrastructure, but also places such as restaurants, warehouses, and shops. The common feature of these actions – each posing a threat to public security – is the attempt to disrupt the functioning of the state and to sow confusion and uncertainty among citizens. No less important from the Kremlin’s perspective is testing Polish crisis-response procedures and reaction times.
Sabotage Acts in Poland
On the weekend of 16-17 November, a sabotage attack occurred on the key Warsaw-Lublin railway route near the Życzyn, Mika, and Puławy stations. An explosive device destroyed the tracks, leaving a crater of about 100 cm. Train drivers from PKP Intercity and Koleje Mazowieckie stopped their trains, preventing a potential disaster. Prime Minister Tusk confirmed on Monday that this was an act of sabotage.
The most common and media-visible form of sabotage observed in Poland in recent years has been arson. A relatively simple method (often just a Molotov cocktail) resulted in multimillion-złoty losses.
- Three Poles and three Belarusians were involved in the arsons that occurred in Gdynia, Gdańsk, and Marki in 2023 and 2024. It was established beyond doubt that they acted on behalf of Russian intelligence. The Prosecutor’s Office accused them of setting fire to a restaurant in Gdynia, attempting to burn down a warehouse in Gdańsk, and burning a pallet depot in Marki near Warsaw. The indictment was submitted to the court in August this year, and the defendants face sentences of up to life imprisonment.
- In January of last year, the Internal Security Agency disclosed preparations for arson attacks in Wrocław. The targets included a paint factory and other facilities. A Ukrainian national was arrested for allegedly accepting an assignment from Russian services.
- In April of last year, a fire broke out at an OBI store on Radzymińska Street in Warsaw, destroying part of the store and causing losses of more than 3.5 million złoty. Charges were brought against Belarusian citizen Stepan K., who was found to have acted on behalf of Russian intelligence.
- In May of last year, a construction-supply warehouse in Warsaw was set on fire. A Colombian national accused of the act had allegedly accepted from Russian services an assignment to burn down another construction warehouse in Radom.
- On 12 May 2024, a fire engulfed the Marywilska 44 Shopping Centre in Warsaw, destroying nearly 1,400 retail stalls. Ukrainian, Belarusian, and Lithuanian nationals – tasked by Russian military intelligence – were involved. In May 2024 alone, there were 16 such suspicious incidents.
- In July this year, a series of arsons occurred in Warsaw, including at a selective municipal waste facility in Siekierki and at a waste storage site in Wilanów. Polish services linked these events to Russia’s hybrid operations.
Hybrid Warfare in the Region
- In October 2023, deliberate damage was inflicted on the Balticconnector gas pipeline and a fibre-optic cable linking Estonia with Finland. Local authorities attributed responsibility to Russia and its so-called “shadow fleet.”
- In November 2024, in similar circumstances, a fibre-optic cable connecting Lithuania and Sweden was severed. At the same time, a cable connecting Estonia and Germany was damaged.
- In January and February of this year, four incidents of damage to telecommunications and power cables occurred – those linking Estonia with Finland and Lithuania with Sweden.
- In May of last year, an IKEA warehouse in Vilnius was set on fire. Ignition devices had been planted inside packages. Losses were estimated at around 5 million euros.
- In April of this year, a plot to burn shopping centres in Latvia was uncovered. Fifteen individuals were charged – including Russians, Lithuanians, Latvians, Estonians, and Ukrainians. Earlier, in 2023, one defence-industry business in Latvia had been set on fire.
- In October this year, again in Latvia, a plan to attack critical infrastructure sites was revealed. The perpetrators had been conducting reconnaissance and filming potential targets.
- Since February 2022, there has been a sharp increase in GPS signal disruptions over the Baltic Sea. Sweden alone has recorded 733 such incidents this year, and Finland 84. As a result of Russian actions, ships and aircraft are forced to change routes, face delays, or even be evacuated. The problem also affects Poland and other Baltic states.
In March 2023, the Internal Security Agency dismantled the largest spy network in Polish history operating for Russian intelligence (FSB). The group, at least 16 individuals, mainly Ukrainians and Belarusians, plus one Russian, conducted intelligence operations, surveillance of military sites and ports, and prepared acts of sabotage, including attempts to destabilize transport routes and blow up trains carrying aid to Ukraine. The network was remotely directed by a Russian officer known as “Andrei.”
According to information from the National Prosecutor’s Office and the Internal Security Agency, since 2022 the number of cases involving sabotage- and terrorism-related acts inspired by Russian services has tripled. Experts warn of the potential escalation of Kremlin hybrid warfare, including the increased use of drones and cyberattacks.