Poland investigates Russian-linked sabotage of Starlink infrastructure

Poland’s investigation into the September fire at a Starlink ground station in Wola Krobowska has evolved from an ambiguous infrastructure incident into a counterintelligence case that Warsaw now publicly links to Russian services. The most consequential shift came when prosecutors formally reclassified the matter as an alleged act of diversion and terrorism carried out on behalf of a foreign intelligence service, followed by the arrest in Germany of two Turkish nationals suspected of involvement. Polish officials say the target was not just a domestic telecom node but a strategic communications asset serving Central and Eastern Europe, including Ukraine. The case now sits at the intersection of infrastructure security, allied intelligence cooperation, and the broader contest over Russian hybrid operations on NATO territory.

How The Case Escalated

The incident began with the 23 September fire at the Starlink-related site in Wola Krobowska, but the public escalation started on 24 September. Deputy Prime Minister Krzysztof Gawkowski said the fire was being investigated as suspected sabotage and indicated that the likely intent was to disrupt internet access used by the Ukrainian military. That early framing immediately elevated the case beyond a routine industrial fire because it tied the incident to wartime communications support for Ukraine.

Later the same day, Prime Minister Donald Tusk adopted a more cautious public line. On 24 September, he said the fire should not yet be labeled sabotage, while warning that the incident “looks bad” in the context of repeated attacks on infrastructure. At that stage, Polish reporting indicated prosecutors had opened an inquiry immediately because the facility was treated as strategic infrastructure, with the Internal Security Agency (ABW), police, and firefighters on site. Early investigators were still weighing several possibilities: sabotage, arson, or an electrical fault at a generator.

As the day progressed, the official line hardened. Gawkowski said the 23 September fire was being treated as possible sabotage and that ABW was checking whether the act had been deliberate. He did not name a perpetrator, but he explicitly placed the case in the wider hybrid-threat environment and linked the site’s importance to regional connectivity, including Ukraine-related communications.

A further update on 24 September pushed the case closer to a national-security emergency. Gawkowski said publicly that the damage appeared deliberate and intended to disable connectivity for Central and Eastern Europe, including Ukraine, while also noting that operations had been restored. Polish reporting added that the District Prosecutor’s Office in Grójec had opened proceedings and that ABW, police, and specialist central units were notified immediately. That combination, restored service but expanded security involvement, signaled that the immediate operational disruption had been contained, but the strategic implications were widening.

From Fire Inquiry To Counterintelligence And Terrorism Probe

The decisive legal shift came on 27 September, disclosed publicly on 28 September, when the Warsaw prosecutor’s office opened a formal investigation into the fire and qualified it as an alleged act of diversion and terrorism carried out on behalf of a foreign intelligence service against Poland. That was the point at which the case moved clearly from a technical or criminal inquiry into a counterintelligence track centered on hostile state-directed activity.

On 2 October, Poland’s National Prosecutor’s Office reinforced that shift. It said the Wola Krobowska fire was under investigation as sabotage and terrorism carried out on behalf of a foreign intelligence service, and prosecutors indicated suspected direction from Russian special services. This was not yet the full political attribution later made by ministers, but it was the first explicit prosecutorial indication that investigators were looking at Russian direction rather than an unspecified foreign hand.

Reporting on 5 October added important operational detail about the state response in the immediate aftermath. Onet said Polish services had brought in ABW, the Central Bureau of Investigation of Police (CBŚP), and the Central Bureau for Combating Cybercrime (CBZC) right after the fire because the site was treated as strategic communications infrastructure serving Central and Eastern Europe, including Ukraine. Officials also said the inquiry could be upgraded if evidence pointed to sabotage or organized criminal involvement.

That reporting sat awkwardly against the earlier prosecutorial escalation, because by then the case had already been formally reclassified into a diversion and terrorism investigation. The significance is less contradiction than confirmation: multiple arms of the Polish state were converging on the same conclusion from different procedural angles. Prosecutors were building a foreign-intelligence case, while security services were treating the site as a strategic node whose compromise had implications beyond Poland’s borders.

Arrests In Germany And Public Attribution To Russia

The next major turn came on 13 October, when Polish and German authorities announced the arrest in Germany of two Turkish nationals over the arson attack. Polish Interior Minister Marcin Kierwiński said the case was one of sabotage and diversion for a foreign intelligence service, while Tomasz Siemoniak, the minister coordinating special services, said Poland had no doubts that Russian services were behind the operation.

A second update the same day sharpened the political message further. Poland said Russia was responsible for the September arson attack and described it as an act of hybrid warfare. It also confirmed that the two Turkish citizens had been arrested in Germany in connection with the case. That language matters: “hybrid warfare” places the incident in the same category as covert, deniable operations designed to impose costs below the threshold of open military confrontation.

The 24 October update added a more precise account of the cross-border operation. Poland’s Interior Ministry said that on 12 October 2026, German authorities arrested the two Turkish citizens suspected of the 23 September arson attack on Starlink-related infrastructure in Wola Krobowska. The operation involved Poland’s Ministry of the Interior and Administration (MSWiA), police, and ABW, underscoring that the arrests were the product of Polish-German operational cooperation rather than a purely domestic German action.

The sequence is important:

- 23 September: fire at the Wola Krobowska Starlink ground station - 24 September: Polish officials publicly raise sabotage concerns; prosecutors and security services mobilize - 27-28 September: formal investigation opened as diversion and terrorism on behalf of a foreign intelligence service - 2 October: prosecutors indicate suspected direction from Russian special services - 12 October: German authorities arrest two Turkish suspects - 13 October: Poland publicly attributes the operation to Russia - 24 October: Polish authorities detail the joint operational role of MSWiA, police, ABW, and German counterparts

This chronology shows a methodical progression from uncertainty to legal reclassification, then to arrests and overt attribution. It also shows that Warsaw waited until after operational action abroad before making its strongest public claims about Russian responsibility.

Vulnerabilities, Stakeholders, And The Procedural Failure

For Poland, the case is about more than one fire. Officials treated the site as strategic communications infrastructure from the outset, suggesting concern that hostile actors were probing vulnerabilities in systems that support both national resilience and Ukraine-related connectivity. The fact that operations were restored reduced the immediate service impact, but not the strategic warning: the attack demonstrated that a node inside Poland could be targeted for effects across the wider region.

For Ukraine, the significance lies in the repeated Polish emphasis that the station supported communications relevant to the Ukrainian military and to regional connectivity. Even if the physical damage was contained, the alleged intent described by Polish officials was to degrade communications used in support of Ukraine. That makes the incident part of the broader contest over sustaining Ukraine’s wartime command, control, and connectivity through infrastructure located in neighboring NATO states.

For Germany, the arrests put Berlin directly into the enforcement side of a hybrid-threat case that originated in Poland. The detention of two Turkish nationals on German territory demonstrates the transnational character of the alleged network and the importance of allied police and intelligence cooperation. It also raises the prospect that European states will face more cases in which operatives, facilitators, and handlers are spread across multiple jurisdictions.

For Russia, the public attribution by Polish ministers increases the diplomatic and intelligence costs even if Moscow rejects the allegations. Warsaw’s language, sabotage, diversion, terrorism, hybrid warfare, signals that Poland sees the incident not as isolated criminality but as part of a broader Russian campaign against critical infrastructure in Europe.

One additional development complicates the picture. On 15 October, Rzeczpospolita reported that the two alleged saboteurs had been briefly detained by Polish police after the arson attack and then released before later evidence linked the operation to actors working on Russia’s behalf. If accurate, that points to a handling failure at an early stage of the investigation. Operationally, it suggests that the initial response may have identified relevant individuals but lacked either the evidentiary basis or procedural coordination to hold them, allowing the case to become more dependent on later intelligence development and foreign cooperation.

That reported lapse matters for two reasons:

- It exposes a possible gap between frontline police action and the later counterintelligence picture assembled by prosecutors and security services. - It may become a domestic political issue inside Poland, separate from the core sabotage case, if questions grow about whether suspects could have been secured earlier.

Risk Trajectory And What The Score Shifts Suggest

The event’s risk and impact scores tracked the investigation’s changing character rather than the physical damage alone. On 24 September, the first scored update put risk at 44 and impact at 41, reflecting uncertainty: the prime minister was cautious, investigators were still balancing sabotage against accidental causes, and attribution was absent.

Later that same day, the scores jumped to 56 risk / 52 impact as Gawkowski said the fire was being treated as possible sabotage and ABW publicly examined deliberate action. The move captured the transition from a fire inquiry to a national-security incident. A subsequent 24 September update eased slightly to 52 / 48, likely because operations had been restored even as officials described the damage as deliberate. In other words, the strategic concern rose, but the immediate operational disruption appeared contained.

The strongest upward move came on 28 September, when the formal diversion-and-terrorism classification pushed the scores to 62 / 58. That increase reflected legal escalation and the explicit involvement of a foreign intelligence service. On 2 October, risk held at 62 while impact dipped to 56, suggesting that suspected Russian direction sustained the threat level even without evidence of broader cascading effects.

The 5 October reporting dropped the scores sharply to 44 / 41, an outlier relative to the broader trajectory. Based on the substance, that lower reading appears to reflect the fact that the update mainly added procedural detail about agency involvement and the possibility of widening the case, rather than a de-escalation in the underlying threat. By 13 October, the scores rose again to 61 / 57 with arrests and explicit senior-level attribution to Russian services, then settled at 58 / 54 later the same day as the public narrative consolidated around hybrid warfare and the German arrests. The 15 October report on the alleged release of the suspects lowered the scores to 48 / 44, likely because it introduced a domestic procedural failure rather than a new external escalation. The 24 October update returned the event to 58 / 54, reflecting the significance of named foreign suspects, cross-border operational cooperation, and reaffirmed attribution to Russian services.

Taken together, the score pattern suggests three things:

- The main driver of risk has been attribution and legal classification, not the fire damage itself. - Impact has remained somewhat lower than risk because service restoration limited immediate operational fallout. - The case retains a persistent elevated threat profile because it now fits a broader pattern of suspected hybrid operations against critical infrastructure rather than a one-off incident.

Outlook

The next phase will hinge on whether Polish and German authorities convert public attribution into a durable evidentiary case against the two arrested suspects and any wider network behind them. The most important signals to watch are court filings or prosecutorial disclosures, any new ABW findings on Russian direction, and whether NATO or allied governments use the case to justify stronger protective measures for communications infrastructure. If Warsaw produces more detail on command links, financing, or tasking, the incident could become a reference case for how Europe publicly documents and counters Russian-linked sabotage on allied territory.